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COMPUTING IMAGES OF GALOIS REPRESENTATIONS 
ATTACHED TO ELLIPTIC CURVES 

ANDREW V. SUTHERLAND 


Abstract. Let E be an elliptic curve without complex multiplication (CM) over a number field K, and let 
Ge {.(■) be the image of the Galois representation induced by the action of the absolute Galois group of K on 
the Gtorsion subgroup of E. We present two probabilistic algorithms to simultaneously determine Ge (^) up 
to local conjugacy for all primes £ by sampling images of Frobenius elements; one is of Las Vegas type and 
the other is a Monte Carlo algorithm. They determine Ge{^) up to one of at most two isomorphic conjugacy 
classes of subgroups of GL 2 (Z/£Z) that have the same semisimplification, each of which occurs for an elliptic 
curve isogenous to E. Under the GRH, their running times are polynomial in the bit-size n of an integral 
Weierstrass equation for E, and for our Monte Carlo algorithm, quasi-linear in n. We have applied our 
algorithms to the non-CM elliptic curves in Cremona’s tables and the Stein-Watkins database, some 140 
million curves of conductor up to 10^®, thereby obtaining a conjecturally complete list of 63 exceptional 
Galois images Ge{() that arise for E/Q without GM. Under this conjecture we determine a complete list of 
160 exceptional Galois images Ge{^) the arise for non-CM elliptic curves over quadratic fields with rational 
j-invariants. We also give examples of exceptional Galois images that arise for non-CM elliptic curves over 
quadratic fields only when the j-invariant is irrational. 
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1. Introduction 


Let E be an elliptic curve over a number field K with algebraic closure K. For each integer m > 1, 
let E\m\ denote the m-torsion subgroup of E{K), which we recall is a free Ti/m'L module of rank 2. The 
absolute Galois group Gsi\{K/K) acts on E\m] via its action on the coordinates of its points, and this action 
induces a Galois representation (a continuous homomorphism): 

PE,m- G&\{K/K) ^ Aut(F;[m]) ~ GLsM := GL 2 (Z/mZ). 

We regard the image of pE,m as a subgroup GE(m) of GL 2 (m) that is determined only up to conjugacy, 
since the isomorphism Aut(£'[m]) ~ GL 2 (m) depends on a choice of basis. For fixed E and varying m, the 
representations pE,m form a compatible system, and we have the adelic Galois representation 

Pe: G&\{K/K) GL2(Z) = lmGL2(m), 

m 

whose image we denote Ge- 

By Serre’s open image theorem (see [57, §IV.3.2] and [58]), so long as E does not have complex multi¬ 
plication (CM), the adelic image Ge has finite index in GL 2 (Z). In particular, there is a minimal positive 
integer niE for which Ge is the full inverse image of G£;(m£;), and a finite set Se of exceptional primes i 
for which Ge{() is properly contained in GL 2 (.^). Each such I necessarily divides m^, but the converse 
is not true in general (and almost never true for elliptic curves over Q). Nevertheless, a first step toward 
computing mE and GEirriE) is to determine the set Se and the groups Ge{(-) for ^ € Se- 

A related motivating question is this: for a given number field K, which exceptional groups Ge{(-) can 
arise for a non-CM elliptic curve E/Kl Serre’s theorem implies that for any fixed E this is a finite list, and 
Serre has asked whether this is still true when only K is fixed and EjK is allowed to vary; it is expected 
that the answer is yes. This can be regarded as a generalization of Mazur’s results [46, 47], which determine 
the primes ^ for which an elliptic curve E/Q may admit a rational point of order £, or a rational isogeny 
of degree Both of these properties are determined by Ge{£), but the converse does not hold: Ge{(-) may 
be exceptional when E does not admit a rational isogeny of degree and even when E has a rational point 
of order £, many different Ge{(-) may occur. Serre’s question remains open for all number fields K, but 
there has been some recent progress in the case K = Q: for ^ > 37 any exceptional Ge{^) must lie in the 
normalizer of a non-split Cartan group in GL 2 (^), as shown in [5], and for £ < 11 the possible Ge{() have 
been completely determined [74]. Little is known for number fields other than Q. 

We are thus led to the problem at hand: given an elliptic curve E/K without CM, determine the set Se of 
exceptional primes I and the groups Ge{£) for each prime £ G Se- Serre’s open image theorem can be made 
effective, and under the generalized Riemann hypothesis (GRH) reasonably good bounds on the exceptional 
primes i are known; quasi-linear in the norm of the conductor of E, by [42]. This leaves the problem of 
computing Ge{£)- In principle this is straight-forward: pick a basis for E[P\ and compute the action of 
Gd\{K/K) on this basis. This approach can be made completely effective. The points in E[£\ are defined 
over the Atorsion field K{E\£])^ which is an extension of the splitting field of the ^division polynomial 
fE,e{x) whose roots are the ^-coordinates of the non-trivial Atorsion points. Using well-known formulas for 
fE,i{x) one can explicitly construct its splitting field and take a quadratic extension if necessary to obtain 
the ^-coordinates of the points in E[£] (a quadratic extension always suffices, see Lemma 5.17). One then 
finds generators for Gal{K{E[£])/K) and applies them to a basis for E[£]. Using the algorithm in [40], this 
computation can be accomplished in deterministic polynomial time; a Magma [11] script that implements 
this procedure is available at the author’s website [68]. 

Unfortunately this is feasible only for very small i- While Gd\{K{E\i\)/K) can be computed in time 
polynomial in £, the exponents involved are quite large; indeed, the necessary first step of factoring fE,i{x) 
is already non-trivial, even when K = Q. For i > 2 the polynomial fE,t has degree (£^ — l)/2 and 
coefficients with bit-size 0(£^), which gives an C)(£^^+°(^)) time for factoring fE,e € Z[a;] using the best 
known bounds for polynomial factorization [54]. More generally, the time to factor /e/ in K[x\ given in [40] 
is [K : and the time to compute its splitting field my be substantially larger. By contrast, 

the Monte Garlo algorithm presented in this article computes Ge{£) up to local conjugacy (as defined below) 
in time that is quasi-linear in both i and [IF: Q]; in fact it does this simultaneously for all primes in in 
time quasi-linear in max(S'£;). 
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Two Galois representations pi,p 2 - Ga\{K/K) GL 2 (to) are said to be locally conjugate if pi(cr) and 
P 2 (ct) are conjugate in GL 2 (to) for every cr £ Gal(it'/A") (not necessarily by the same matrix in each case). 
We call two subgroups G and H of GL 2 (m) locally conjugate if there is a bijection of sets that maps each 
5 £ G to an element h € H that is conjugate to g in GL 2 (m); equivalently, (GL 2 (m), G, H) is a (non-trivial) 
Gassmann-Sunada triple [31, 69]. Local conjugacy defines an equivalence relation on subgroups of GL 2 (m). 

We present two probabilistic algorithms to determine the exceptional primes i for a given elliptic curve 
EjK and to determine the groups Ge{(-) up to local conjugacy. The algorithms work by computing the 
images in Ge{() of Frobenius elements (conjugacy classes) Frobp for unramified primes p/£ of AT where E 
has good reduction, either for all p of bounded norm, or for randomly chosen p with norms in a bounded 
interval. This implies that our algorithms can only determine Ge{(-) up to local conjugacy, but we show that 
this imposes very strong constraints on Ge{(-). In particular, we prove that every local conjugacy class of 
subgroups of GL 2 (£) consists of at most two conjugacy classes of subgroups of GL 2 (.^) that are isomorphic 
as abstract groups and have the same semisimplihcation. Moreover, we prove that whenever Ge{£) is locally 
conjugate to a subgroup G' of GL 2 (£), there is an isogenous elliptic curve E'jK for which Ge'{£) = G'; see 
Theorem 3.32. We also describe some global methods for efficiently distinguishing pairs of locally conjugate 
but non-conjugate Galois images that are applicable in most (but not all) cases, including every case that 
we encountered in our computations; see Section 5.5. 

To compute the conjugacy class (Frobp) for unramified primes p of AT that do not divide m we rely 
on three fundamental algorithms for elliptic curves over finite fields that we apply to the reduction Ep/Fp of 
E modulo p; here Fp := Ok/P is the residue field, a finite field with q := A^(p) elements. The first is School’s 
algorithm [55, 56], which computes the trace f £ Z of the Frobenius endomorphism in time polynomial in 
log q. The second is a Las Vegas algorithm to compute the endomorphism ring End(Ap) when Ep is ordinary, 
due to Bisson and the author [8, 9]; under the GRH its expected running time is subexponential in logg. It 
follows from a theorem of Duke and Toth [25] that the pair (f,End(Ap)) determines an integer matrix ^p 
whose reduction modulo m lies in the conjugacy class (Frobp) for every positive integer m. The third 
is Miller’s algorithm to compute the Weil pairing [49], which we use to compute the rank of the Gtorsion 
subgroup of Ap(Fp) in quasi-cubic time. This allows us to determine the dimension of the 1-eigenspace of 
P£;,^(Frobp) without computing Ap, providing an efficient method to distinguish unipotent elements of Ge{(-), 
which are not distinguished by their characteristic polynomials. 

In order to bound the norms of the primes p that we use, we rely on explicit Ghebotarev bounds that 
depend on the GRH. In principle our algorithms can be implemented so that they do not rely on this 
hypothesis, but the running times would increase exponentially. The GRH also gives us bounds on the largest 
exceptional prime £ that can occur for a given elliptic curve A/AT; the results of Larson and Vaintrob [42] 
give bounds that are quasi-linear in log where Ne is the absolute value of the norm of the conductor 
of E. Together these allow us to bound the norms of the primes p that we must consider by a polynomial in 
log II/II I where ||/|| denotes the maximum of the absolute values of the norms of the coefficients appearing 
in an integral Weierstrass equation y'^ = f{x) for E. 

We now state our two main results. The first is a Las Vegas algorithm that, given an elliptic curve 
EjK specihed by an integral Weierstrass equation, outputs a complete list Se oi the primes £ for which 
Ge{G) ^ GL 2 (£) and for each £ G Se a subgroup of GL 2 (£) specified by generators that is locally conjugate 
to Ge(£)', see Algorithm 5. Under the GRH its expected running time is bounded by 

(log||/||)''+°« 

in Theorem 5.7. Our second main result is a Monte Garlo algorithm that has the same output as our Las 
Vegas algorithm and is correct with probability at least 2/3; see Algorithm 7. Its error is one-sided in 
the sense that each subgroup of GL 2 (£) output by the algorithm is guaranteed to be locally conjugate to 
a subgroup of Ge(£), but it may be a proper subgroup. By running the algorithm repeatedly the error 
probability can be made arbitrarily small. Under the GRH its running time is bounded by 

(log||/||)'+°«, 

which is quasi-linear in the size of the input, the equation y'^ = f{x); see Theorem 5.15. 

An essential ingredient to both of our algorithms is the ability to distinguish and explicitly construct 
subgroups of GL 2 (£) based on a compact representation of a subset of their element conjugacy classes. The 


3 


classification of the possible images of subgroups of GL 2 (^) in PGL 2 (^) has long been known [23], but for our 
we work we require a complete list of the subgroups of GL 2 (£) up to conjugacy, and a precise understanding 
of the element conjugacy classes each contains. We address these questions in Section 3, in which we obtain 
exact formulas for the number of subgroups of GL 2 (£) up to conjugacy (and for subgroups of various types) 
that may be of independent interest. We also give a quasi-linear time algorithm to enumerate these subgroups 
with explicit generators for each; see Algorithm 2. 

We have applied our algorithms to various databases of elliptic curves over Q, including all non-CM curves 
of conductor up to 350,000 listed in Cremona’s tables [19], and the non-CM curves in the Stein-Watkins 
database [61], which includes a large proportion of all elliptic curves over Q of conductor up to 10®, and of 
prime conductor up to 10^®; some 140 million elliptic curves in all. We also analyzed parameterized families 
of elliptic curves that are known to have exceptional Galois images, and large families of elliptic curves of 
bounded height (more than 10® curves). In each case we were able to compute a complete list Se oi the 
exceptional primes i and the subgroups Ge{(-) up to conjugacy (not just local conjugacy), using the methods 
described in §5.5. This work yields a conjecturally complete list of 63 exceptional subgroup conjugacy classes 
that arise as Ge{G) for some non-CM elliptic curve if/Q and prime these are listed in Tables 3 and 4 of 
Section 6. Thanks to recent work by Zywina [74], we have been able to independently verify our results for 
all the non-CM elliptic curves in Cremona’s tables, and in every case we found that the output of our Monte 
Carlo algorithm (which we executed repeatedly in order to amplify its success probability) was correct. This 
motivates the following conjecture: 

Conjecture 1.1. Let E/Q be an elliptic curve without complex multiplication and let £ be a prime. Then 
Ge{£) is either equal to GL 2 (^) or conjugate to one of the 63 groups listed in Tables 3 and j. 

Under this conjecture we determine a complete list of 160 exceptional Galois images Ge{£) not containing 
SL 2 (.^) that arise for non-CM elliptic curves with rational j-invariants over quadratic fields; these include 
the 63 groups that already arise over Q along with 68 new groups that arise for base changes of elliptic 
curves over Q, and 29 that arise for quadratic twists of these curves but not for any base change from Q; 
see Theorem 6.3 and Tables 5-8. A key ingredient to this result is an analysis of how Gef{£) varies within a 
family of quadratic twists of a fixed elliptic curve EjK as F varies over quadratic extensions of A"; this 
appears in §5.6. We find that for any odd prime £, up to 3 non-conjugate groups GEr{£) may arise in such a 
family and we give an explicit method to determine quadratic extensions FjK that realize every possibility. 

We have also run our algorithms on tables of elliptic curves defined over quadratic fields that have recently 
been made available in the L-functions and Modular Forms Database (LMFDB) [45], including the five real 
quadratic fields and five imaginary quadratic fields of least absolute discriminant. Examples of exceptional 
Galois images Ge{£) that occur only for non-CM elliptic curves with irrational j-invariants over these helds 
are listed in the tables at the end of Section 6, as well as examples over the cubic field of discriminant —23. 

In principle our algorithms can also be used to determine GE(jn) up to local conjugacy for any positive 
integer to, but the situation is more complicated when to is composite for three reasons: (I) local conjugacy 
imposes fewer constraints when to is composite, for example locally conjugate subgroups of GL 2 (to) need not 
be isomorphic; (2) the integers to for which G_e(to) is exceptional and not the full inverse image of GEijn ') 
for some m'\m may be exponentially larger than the largest exceptional prime £; (3) our understanding of the 
subgroup structure of GL 2 (to) is less refined that it is for GL 2 (£). In spite of these obstacles, it is entirely 
feasible to apply our algorithms when to is small, and if we set the more modest goal of simply computing 
the index of GE{m) in GL 2 (to), this can be done quite efficiently. This suggests a practical method for 
computing tob and the index of Gb in GL 2 (Z) for a non-CM elliptic curve E/K that we plan to address in 
a future article. 

1.1. Acknowledgements. The author is grateful to Nicholas Katz for his support, and for asking the 
questions that motivated this research, and to David Zywina for several fruitful discussions. The author also 
wishes to thank John Cremona and William Stein for their assistance with many of the computations. 

2. Notation and Terminology 

Throughout this article the symbols £ and p denote rational primes, and r, to and n denote positive 
integers. We use 'r(n) to denote the number of positive divisors of an integer n and (j(n) := ^(Z/nZ)’^ for 
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the Euler function. For any prime power q, we use to denote the field with q elements. For sets S and T 
we write S — T for the set of elements of S that do not lie in T. 

For any ring R, we use to denote the ring of r x r matrices, GLr(i?) for its multiplicative 

subgroup of invertible matrices, SLr(i?) for the kernel of the determinant map det: GLr(i?) —>■ GLi(i?), 
and PGLr(i?) for the quotient of GLj.(i?) by its center. For each integer to > 1 we define the notations 

Z(to) := Z/toZ, Mr(TO) := Mr(Z/TOZ), 

SL,.(to) := SL^(Z/toZ), GL^(to) := GL^(Z/toZ), PGLr{m) := PGL^(Z/toZ). 

The center of GL 2 (to) consists of the subgroup of scalar matrices ( q ° which we denote Z{m)-, when there 
is no risk of ambiguity we may identify Z{m) ~ Z(to)^ and use z to denote (§ ° )• The scalar matrices form 
the kernel of the canonical projection 

tt: GL2(to) ^ PGL2(to) 

which we denote by tt throughout. 

In our identification of Aut(F[TO]) with GL2(to), we view elements of GL2(to) as 2 x 2 matrices acting on 
column vectors by multiplication on the left, and distinguish subgroups of GL 2 (to) only up to conjugacy. 
For an elliptic curve E over a number field if, composing the 2-dimensional representation 

PE- Gal(7f/if) ^ GL 2 (Z) 

with the determinant map GL 2 (Z) —>■ Z^ induces a 1-dimensional representation 

detop^: Gal(If/if)GLi(Z) = Z^. 

Throughout this article we use p to denote a prime of if, by which we mean a nonzero prime ideal in its 
ring of integers Ok, and we use Fp to denote the residue field Ok/ p- For each prime p/to that is unramified 
in if(ii[TO])/if (all but finitely many p), the value of detop^; on the Frobenius element Frobp (which we 
recall is defined only up to conjugacy) is iV(p) := [Ok ■ p]- The image of detop^ thus depends only on if, 
not on F; in fact, it depends only on the intersection of if with the maximal cyclotomic extension of 
Q in if, and detop^;^^ is surjective for all but finitely many £. 

Our complexity bounds always count bit operations. We use M(n) to denote the time to multiply two 
n-bit integers, which we may bound by 

M(n) = n(logn)^~'’°*-^^ 

via [53]; see [34] for a more precise bound. This bound implies that arithmetic operations in finite fields F^ 
can be performed in (logg)^^°^^^ time, which we assume throughout (we refer the reader to [32] for details). 

Many of the algorithms we present are probabilistic algorithms, which we recall are typically classified as 
one of two types. Las Vegas algorithms produce output that is guaranteed to be correct but have potentially 
unbounded running times that may depend on probabilistic choices; for such algorithms we bound their 
expected running time, which is required to be finite. Monte Carlo algorithms, by contrast, have bounded 
running times but may produce outputs that are incorrect with probability bounded by some c < 1/2; we 
use c = 1/3. Assuming the correct output is unique, by running a Monte Carlo algorithm repeatedly and 
choosing the output produced most frequently, the probability of error can be made arbitrarily close to zero 
at a rate exponential in the number of repetitions. 

For integers n > 3, we use A„ and Sn to denote the alternating and symmetric groups on n elements, 
respectively. For the purpose of this article we consider the non-cyclic group of order 4 (the Klein group) to 
be a dihedral group. 


3. Subgroups of GL2(F|) 

The classification of subgroups of PGL 2 (£) is well known (see Proposition 3.1 below). Our algorithms 
require a more refined classification of the subgroups of GL 2 (^), up to conjugacy in GL 2 (^), that allows us 
to distinguish subgroups by sampling element conjugacy classes corresponding to Frobenius elements. In 
this section we obtain such a classification, as well as explicit formulas to count subgroups of GL 2 (£) up to 
conjugacy and an efficient algorithm to enumerate them. Many of the proofs in this section are elementary, 
but as our algorithms depend crucially on these results, we give at least a sketch of each proof. Except when 
the case £ = 2 is specifically noted, we assume throughout this section that £ is an odd prime. 
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For any g G GL 2 (£) we define the discriminant 


A(g) := tr(c/)2 


4det(g) e Z(£), 


and its quadratic character 

X(ff) ■■= €{-1,0,1}. 

For ease of reference we list the element conjugacy classes of GL 2 (^) in Table 1. Here and throughout, s 
denotes a fixed non-square element of Z(£)^; for the sake of concreteness, let e be the least positive integer 
that generates Z(£)^. We note that ( o y) and ( q ° ) are conjugate via (? J), and (y^x) and ( ) are 

conjugate via ( q _?i), which explains the restrictions on y in Table 1 below. 


representative 

size 

number 

det 

tr 

X 

order 

(g°) 

0 < X < £ 

1 

£-1 


2x 

0 

divides £ — 1 

(gP 

0 < X < £ 

£2 - 1 

£-1 

x‘^ 

2x 

0 

divisible by £ 

(Sg) 

0 < X < y < £ 

£2 + £ 


xy 

x + y 

-bl 

divides £ — 1 

( X ey\ 
\y X j 

o<g< Y 

£2 -£ 

(D 

9 2 

— ey 

2x 

-1 

divides £^ — 1 


Table 1. Element conjugacy classes in GL 2 (£) for primes £ > 2. 


For any g € GL 2 (t') and positive integer n, the trace of g” can be computed as trg" = a„, where a„ is 
defined by the recurrence: 

( 1 ) ao := 2 , ai:=tr( 5 ), a „+2 := aia„+i - a„ det g. 


This implies that for elements g whose order is not divisible by £, we can derive |g| from {detg,tTg). We 
are also interested in the order of the image of g in PGL 2 (£). For this purpose we define 


u{g) := 


det(g) 


G Z{£). 


If |g| is divisible by £ then g is conjugate to some (§ }) and u(g) = 4. Otherwise, the order r of 7 r(g) in 
PGL 2 (^) is prime to I and we have 


(2) «((;) — ('r -b Cr ^ + 2, 

for some primitive rth root of unity for which + € F^, as explained in [41, p. 190]. Note that C,r may lie 

in a quadratic extension Ff, but in any case r divides either £—1 or £- 1-1 and is uniquely determined by u{g); 
this allows | 7 r(g)| = r to be unambiguously determined from u{g), and hence from (det 5 ,tr( 7 ) whenever \g\ 
is prime to £. This implies, in particular, that the elements of GL 2 (£) that have order 2 in PGL 2 (£) are 
precisely the elements of trace zero. 

For each odd prime £ we define the split Cartan group Cs{£) and non-split Cartan group Cns{£) by 


Cs{£) :={(g°) :x2/^0}cGL2(£), 

Cns{£) := urn ■■ ry) ^ (0,0)1 C GL2(£), 


and note that Cs {£) — Ff x F^ and Cns {£) — F}),. Both Cg {£) and Cns {£) have index 2 in their normalizers 
C'+(£) := a(£) U (0 1) C., €7+(£) := U (J 

Elements of G+(£) that are conjugate in GL 2 (£) are conjugate in G+(£), and similarly for C'+g(£). We define 
Cs{2) as the trivial group, and C'„s( 2 ) as the kernel of the sign homomorphism GL 2 ( 2 ) ~ S 3 ^ {ilj, both 
are normal in GL 2 ( 2 ). 

We refer to the conjugates of Cs{£) and Cns{£) in GL 2 (£) as split and non-split Cartan groups, respectively. 
Eor £ > 2 all elements in the non-trivial coset of a Cartan group in its normalizer have trace zero, and the 
square of such an element g is the scalar matrix (§ °), where z = — det g. 

The Borel group Bil) C GL 2 (£) is the subgroup of upper triangular matrices; we refer to its conjugates 
in GL 2 (F^) as Borel groups. For £ > 2, the group B{i) is nonabelian, and its commutator subgroup B{iy 
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is the cyclic group of order i generated by ( q }). The split Cartan subgroup Cs{tj is contained in B{£), and 
for £ > 2 it is isomorphic to the abelian quotient B{£)/[B{£), B{£)]. We also note that 

Zi£) = C,i£)nC„si£)^Bi£). 

We now recall the classification of subgroups of G'L 2 {£) in terms of their images in PGL 2 (-^), originally 
due to Dickson [23]. 

Proposition 3.1. Let £ be an odd prime and let G he a subgroup o/GL 2 (£) with image H in PGL 2 (£). 
If G contains an element of order £ then G C B{£) or SL 2 (£) C G. Otherwise, one of the following holds: 

(1) H is cyclic and G lies in a Cartan group; 

(2) H is dihedral and G lies in the normalizer of a Cartan group, but not in any Cartan group; 

(3) H is isomorphic to A 4 , S 4 , or A 5 and G is not contained in the normalizer of any Cartan group. 

Proof. See [70, Lem. 2] or [58, §2]. □ 

Remark 3.2. In the exceptional case (3), if G contains an element whose determinant is not a square, 
then H contains a subgroup of index 2 , which rules out iJ ~ A4 and iL ~ A5. This applies when G = Ge{£) 
arises from an elliptic curve E over a number field K that does not contain the quadratic subfield of the 
cyclotomic field Q(0), which includes K = Q. 

3.1. Borel cases. In this section we address subgroups of the Borel group B{£) that contain an element of 
order £ (hence do not lie in Gs{£)), where £ is an odd prime. 

Lemma 3.3. Let £ be an odd prime and let G be a subgroup of B{£) that contains an element of order £. 
Then G contains t = (0 [) and is equal to the internal semidirect product 

G={t)x {GnGs{£)), 

which is a direct product if and only if G H Cs{£) C Z{£). 

Proof. If G contains an element g = (q of order divisible £ then g^~^ = ( 01 ) for some nonzero x, and 
for ex = 1 mod £ we have = t £ G. For any g = ( q []) the product gC = ( q is diagonal if and 

only if e = —d/a mod £. Thus every coset of (t) in G contains a unique element oi H = G D Gs{£). Thus 
G = (t) XI H, since (t) is normal in G, and the action of H on (t) is trivial if and only \i H f- Z{£). □ 

Formulas to count subgroups of a given finite abelian group are well known; see [ 6 ], for example. In the 
case of interest here, the answer is particularly simple. The lemma below is a special case of [71, Thm. 4.1]. 

Lemma 3.4. Let n be a positive integer. There is a one-to-one correspondence between triples (a, b, i) with 
a,b\n and 0 <i < gcd(a, 6 ) given by 

(a, b, i) I—>■ ((a, —a), (zc, d — ic)), 

where c = a/ gcd(a, b) and d = n/b. The number of distinct subgroups of Z(n) x Z(n) is thus 

a(«) := gcd(a, 6 ). 

a,b\n 

Proof. For each subgroup of H C Z(n) x Z(n) there is a triple {a,b,i) with a,b\n and 0 < z < gcd(a, 6 ) 
determined by the generator x = (a,—a) of the trace zero subgroup Hq C H, the order b of H/Hq, and 
the least z > 0 for which y := (iaj gcd(a, 5), n/b — za/gcd(a, 6 )) € H. Conversely, each such triple {a,b,i) 
determines a subgroup H = {x,y); we thus have a bijection and a{n) counts the triples {a,b,i). □ 

Corollary 3.5. Let £ be an odd prime. The number of non-conjugate subgroups of GL 2 (£) that lie in a 
Borel group and contain an element of order £ is a{£ — 1), the number of subgroups of Cs{£). 

Proof. It suffices to consider subgroups G C B{£) containing (J }) up to conjugation in B{£), since B{£) is self- 
normalizing in GL 2 (^). Every such G is normal in B{£): the subgroup generated by ( q ]) is normal and the 
R(^)-conjugates of GnGs(£) all lie in G. This gives a one-to-one correspondence between subgroups of B{£) 
containing (J [), all of which are non-conjugate, and subgroups of Gs{£) ~ x ~ Z(^— 1 ) x Z(£— 1 ). □ 

Lemma 3.6. Let £ he an odd prime. Let G and H be conjugate subgroups of GIj 2 i£) that lie in Gs{£) and let 
t = {q\). The groups G' := (G,t) and H' := {H,t) of B(£) are locally conjugate in GL 2 (£) and isomorphic. 
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Proof. When G = H the lemma clearly holds, so we assume G H, m which case G and H are conjugate 
via s = ill). We have G' = (t) x G and H' = (t) x H, by Lemma 3.3, and the bijection from G' to H' given 
by swapping diagonal entries preserves conjugacy classes (but is typically not a homomorphism), hence G' 
and H' are locally conjugate. Let g £ G be an element with maximal projective order e, and let 2 ; £ G be a 
generator for Gfl Z{i) with order /; then 5 ® = z'^ for some integer d £ [1,-^ — 1]. We have gtg~^ = G, where 
n £ is the ratio of the diagonal entries of g, while z commutes with t and g. Thus G' is isomorphic 

to the abstract group 

G ■= {t,g,z : = g'^z~'^ = = ztz~^t~^ = zgz~^g~^ = gtg~^t~"‘ = 1 ). 

We now note that t lies in id', and 2 : generates H' nZ(£). The element h = sgs of H has maximal projective 
order e, with h® = z‘^, and hth~^ = where 1/n is the inverse of n and has order e in ifLjiTf)^. The 
action of h' = on t is thus identical to that of g, and there exists a z' G H' D Z(£) of the same order / 

as z for which {h'Y = {z'Y- It follows that H' is also isomorphic to G- Q 

Remark 3.7. The situation in Lemma 3.6 is the only case where non-conjugate but locally conjugate 
subgroups can arise; see Corollary 3.30. 

3.2. Cyclic cases. We now consider the subgroups of GL 2 (.^) with cyclic image in PGL 2 (i!). 

Lemma 3.8. Let n = be a positive integer. The number of subgroups of 'Zi{n) x Z(n) that are fixed 

by the automorphism a : (x, y) [y, x) is 

fin) := P2i'n)W_iep + l)^ 

where P 2 in) = 2 (e| — 62 ) +3ifn even and /? 2 (?t-) = 1 if n is odd. 

Proof. Let G be a subgroup of Z(n) x Z(n) fixed by a. The automorphism a fixes each p-Sylow subgroup 
of G, so it suffices to consider the case ffG = p®. The map p defined by p 1 —>■ <j{g) — p is an endomorphism 
of G with kernel D ■.= {{x.y) G G : x = y} and image contained in T := {(x, y) G G : x + y = 0}. 

If p is odd then p(G) = T and U fl T is trivial, so G = D x T. Conversely, every product of a diagonal 

and trace zero subgroup of Z(n) x Z(n) is fixed by a, and there are {cp + 1)^ such subgroups. 

For p = 2 we have /3(2) = 3, and /3(2"+^) = /3(2") -|-4n, where the An new groups all have exponent 2"+^: 
one is the full group, one is the even trace subgroup of index 2, two are index 4 subgroups ((1,1), (0,4)) 
and ((1,-1), (0,4)), and four are subgroups of index 2*, for i from 3 to n -|- 1, of the form ((1,±1), (0,2*)), 
((1, 2*“^ ± 1), (0, 2*)). The formula for f 2 in) then follows by induction. □ 

Remark 3.9. In terms of the bijection given by Lemma 3.4, the triples (a, b, i) that correspond to subgroups 
of Z(n) X Z(n) fixed by a: (x, y) 1 —>■ (p, x) are those for which the congruence 2ic = d mod a has a solution, 
where c = a/ gcd(a, b) and d = n/b. More generally, two triples (a, b, i) and (a, b,j) correspond to subgroups 
in the same cr-orbit if and only if cii + j) = d mod a has a solution. 

Corollary 3.10. Let I be an odd prime. There are fii— 1) subgroups H of Csii) that are normal in CY{£)- 

Proof. The split Cartan group Csi£) — Z(£ — 1) x Z(^ — 1) is abelian and has index 2 in its normalizer 

Gfii) = (Gsii),s) where s = (? 0 )• It follows that a subgroup H of Csii) is normal in Cfii) if and only if 
it is fixed under conjugation by s, which acts on H by swapping the diagonal entries of each element. □ 

Corollary 3.11. Let I be an odd prime. The number of non-conjugate subgroups o/GL 2 (£) that lie in a 
split Cartan group is 

aii - 1) + fii - 1) 

2 

Proof. It suffices to count GL 2 (i!)-conjugacy classes of subgroups of Csii), and it is enough to consider 

Cfii) conjugacy classes, since G+(£) is the normalizer of Csii). The orbit of each subgroup G C Csii) 

under conjugation by G+ ii) has order 1 or 2, depending on whether G is fixed by the action of (5 g), which 
swaps the diagonal entries. The counting formula then follows from Corollary 3.4 and Lemma 3.8. □ 

Lemma 3.12. Let t be an odd prime. The number of non-conjugate subgroups of GL 2 (£) that lie in a 
non-split Cartan group is t(£^ — 1), where T(n) counts the positive divisors of n. 



Proof. This is clear: Cns{£) — F ^2 is cyclic of order — 1 and therefore contains a subgroup of order n for 
each divisor n of — 1 , none of which are conjugate. □ 

3.3. Dihedral cases. Next up are the subgroups of GL 2 (£) with dihedral image in PGL 2 (t'); as above we 
assume that i is an odd prime and recall that we consider the Klein group to be dihedral. 

If G is a subgroup of GL 2 (.^) with dihedral image in PGL 2 (.^), then G lies in the normalizer G+ of a 
Cartan group G and it contains the abelian subgroup = GflG with index 2. Let Z = GnZ(£) C H denote 
the scalar subgroup of G. The subgroup H is normal in G and in G, hence in G’*' = GG, and it follows that 
each non-scalar element h oi H has a distinct conjugate h G H; indeed, h = ( ? o) (? o) if G = Gs (£) and 

h = ifG = Cns{£))- To better understand the relationship between G and H we consider 

the following maps: 

H^Z {G-H)^Z 

" — I 0 det /i j 9 ^ 9 - y 0 -detg) ■ 

There are two possibilities, depending on whether the set det(iL) and the set 

- det(G - H) ■.= {- detg : g G G - H} (Z GLi(^) 

coincide or not. 

Lemma 3.13. Let £ be an odd prime. Let G he a subgroup of G'L 2 i£) with dihedral image in PGL 2 (f) that 
lies in the normalizer G'^ of a Cartan group G, let H = G G, and let Z = G r\ Z{£). Then H is normal 
in G'^ and one of the following holds: 

(2a) det(iL) and — det(G — H) coincide, in which case G = {H, 7 ) for some 'y G G — H with det 7 = — 1. 
(2b) det(iL) and — det(G — H) are disjoint, in which case det{H) = det(Z) and H contains —1. 

If G' is another subgroup of G~^ with dihedral image in PGL 2 (f) with H = G' r\ G and — det(G' — H) = 

— det(G — H), then G and G' are conjugate in G+. 

Proof. We have [G : iJ] = 2, so is normal in G, and its normalizer in G’*' contains the abelian group G 
and is therefore equal to G’*'; so H is normal in G+. 

If det(iL) and — det(G — H) intersect then we may pick g G G — H and h G H so j = g/h G G — H has 

defy = —1. Then G — H = yiJ and det(iL) = — det(G — H). 

Otherwise det(iL) and — det(G — H) are disjoint. The image of the map H ^ Z is then an even index 
subgroup of Z, and its index is at most 2, since the image of the subgroup Z C H has index 2. It follows 
that det(iL) = det(2') corresponds to an index 2 subgroup of Z, and since Z has even order, it contains —1. 
Now suppose G' is another subgroup of G+ with dihedral image in PGL 2 (£) for which H = G' (IG and 

— det(G' — H) = — det(G — H). In case ( 2 a) we have G' = (i?,7') for some 7' € G — with defy' = —1, 

and then 7' is conjugate to 7 in G+, and therefore G' = {H, 7') is conjugate to G = {H, 7). In case ( 2 b) the 
image of the map g g'^ from (G — H) Z is the non-trivial coset of im(/i 1 —> hh) in Z, thus we may pick 
(g °) € 2 ’ that is the square of some 'j G G — H with det 7 = —z. There must then be a 7' £ G' — iL with 

defy' = —z that is conjugate to 7 in G+, and therefore G' = (i?,7') is conjugate to G = (i?,7). □ 

Remark 3.14. For an elliptic curve E over a number field with a real embedding, the group Ge{£) necessarily 
contains an element 7 with try = 0 and defy = — 1 corresponding to complex conjugation. This implies 
that Ge{£) % Gns(£) for £ > 2 (although Ge(£) Q Gs(£) is possible). Indeed, Gns(3) is the unique subgroup 
G C GL 2 ( 3 ) with det(G) = Fg that does not arise for any elliptic curve E/Q; the corresponding modular 
curve Jf„s(3) has genus zero but no non-cuspidal rational points. 

Remark 3.15. For composite m and elliptic curves E over a number field with a real embedding, the criterion 
that G£;(m) contains an element 7 with try = 0 and det 7 = — 1 is necessary but not sufficient. A stronger 
criterion is that 7 must also fix an order-m element of Z(m) x Z(m). When m is prime this is already implied 
by try = 0 and defy = — 1, but not in general. This explains why, for example, G£;(4) ^ ((2 3) ) (0 3)) 
any elliptic curve E/Q, even though this group contains an element 7 with try = 0 and dety = —1. As in 
the previous remark, the corresponding modular curve has genus 0 but no non-cuspidal rational points. More 
generally, the ten pointless conics noted in [52] that are models of modular curves associated to subgroups 
of GL 2 ( 2 ") lack rational points for this reason. 
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The following lemma determines the cases in which GL2(£)-conjugate subgroups of the normalizer ( 7 + of 
a Cartan group C have intersections with C that are not GL2(£)-conjugate. This can occur only when C 
is a split Cartan group with i = 1 mod 4 and the projective images of the subgroups are isomorphic to the 
Klein group of order 4. 

Lemma 3.16. Let I be an odd prime. Let Gi and G 2 be GLi 2 {(.)-conjugate subgroups of the normalizer 
G~^ of a Cartan group C with dihedral images in PGL 2 (£) such that Hi := Gi fl C and H 2 '■= G 2 H C 
are not conjugate in GL 2 (-^). Then C is a split Cartan group, i = 1 mod 4, |7r(Gi)| = |7r(G2)| = 4, 
Z := ((§°)) := GiCi Z{L) contains —1 with z = square, and {Hi,H 2 } = {((§_? 3 ,)),((o°),(J_?i))}. 
Conversely, whenever £ = 1 mod 4 there is a pair of conjugate Gi and G 2 as above for each scalar subgroup 
((0 z)) contains —1 with z square. 

Proof. Let G2 = gGig~^, let ^ := ((§ ° )) = GiCZ^i) = G 2 r\Z(£), and choose hi G Hi so that Hi = {hi,Z). 
The group Hi is normal in C, and thus contains all the GL2(£)-conjugates of hi that lie in G, none of which 
lie in H2 (otherwise Hi and H2 would coincide). Thus 72 := ghig~^ lies in G2 — H2, and therefore both hi and 
72 have trace zero, and we can similarly choose /12 G H2 so that 71 := g~^h2g lies in Gi — Hi. We then have 
Gi = (/ii,7i,Z) and G2 = {h2,^2,Z) with /ii, ft.2,7i, 72 all elements of trace zero and order 2 in PGL2(^), 
thus 7r(Gi) and tt(G2) are both isomorphic to the Klein group. And Z must contain —1 = hihf^ = h 2 hf^. 

Since Hi and H 2 are non-conjugate we must have dethi fz det /12 (no matter which hi and /i 2 we pick); 
thus one of them is cyclic, say Hi, and the other, H 2 , is not. This rules out the non-split Cartan case, 
so we now assume C = Cs{£). We can assume h\ generates Z, so 2 ; must be square, and we can assume 

= (0 ); and we must have = h^ for some scalar h G Z, so we can assume /12 = (0 -?i) ■ 

Since 71 is conjugate to /12 and 72 is conjugate to hi, so may assume that Gi = ((§ -x) ) (? 0 )) and 
1^2 = (( 0 z)! ( 0 -?i) j (X 0 ))> I'hi® shows whenever £ = 1 mod 4, for each square 2 : G Z{£)^ of even order we 
can construct conjugate Gi and G 2 with Hi and H 2 non-conjugate as above. □ 

Corollary 3.17. Let £ he an odd prime, let 'y = (J ^ 6 ^ S be a generator for Cns {£) ■ For each 

subgroup H C Cns{£) not in Z{£) the group Gi = (i?, 7 ) Q Gi^g{£) has dihedral image in FGJj 2 {£) and 
satisfies H = Gi D G„s(£) with det{H) = — det(Gi — H). If H satisfies det{H) = det(H fl Z{£)) and 
— 1 £ H, then for e” = [Z{£): H fl Z{£)], the group G 2 := {H, 7 ^®) C G+,(£) has dihedral image in PGL 2 (£) 
and satisfies H = G 2 C Cns{£) with det{H) and — det(G 2 — H) disjoint. Up to conjugacy in GIj 2 (£), this 
accounts for all subgroups G that lie in the normalizer of a non-split Cartan group and have dihedral image 
in PGL 2 (t'). The number of such G is 

-l)-r{£-l)+T (^) - ^ (^) • 

Proof. It is clear that Gi and G 2 both have dihedral image in PGL 2 (t?) and intersect Cns{£) in H, since 
7 and 7 r® both lie in G+,(£) but not Gns{£) and their squares lie in H C Z{£). For Gi it is clear that 
det{H) = — det(Gi — H), and for G 2 we note that ( 7 (i®)^ generates H fl Z{£), by construction, and if 
det(iJ) = det(i7 r\Z(£)) then — det( 7 r®) ^ det(iJ), and by Lemma 3.13, the sets det(i7) and — det(G 2 — H) 
must then be disjoint. 

Every subgroup H C Gns{£) is normal in Gif,.{£) and has no non-trivial GL2(^)-conjugates in C'+W- It 
follows from Lemmas 3.13 and 3.16 that up to conjugacy in GL2(£), each Gi,G2 arises for exactly one H. 

The first two terms in the formula count subgroups H C Gns{£) not in Z{£). Among these, those that 
satisfy det(iJ) = det(iJ fl Z{£)) and —IgH are precisely those that lie in the index 2 subgroup of Cns{£) 
(squares) and contain a subgroup of order 2 , which accounts for the last two terms in the formula. □ 

The split dihedral case is slightly more complicated due to the fact that Gg {£) contains subgroups H that 
are not normal in Cf {£), and Lemma 3.16 implies that even when H is normal in G+ {£) it may have distinct 
GL2(^)-conjugates that also lie in Cf{£). 

Corollary 3.18. Let I be an odd prime, let ^ = (? J), and let S G Gb{£) be a coset representative of a 
generator for Cs{£)/{Cs{£) H SL 2 (.^)). For each subgroup H C Gs{£) not in Z[£) that is normal in Cf{£), 
the group Gi = (H,^) C Cf{£) satisfies H = Gi D Gs{£) with det(iJ) = — det(Gi — H). If H satisfies 
det(iJ) = det(i7 fl Z{£)) and —1 G H, then for e := XZiC) : H fl Z{1')\, the group G 2 := {H,^S^) C G+(£) 
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satisfies i? = G '2 fl Cs{i) with det{H) and — det(G '2 — H) disjoint. Up to conjugacy in GL 2 (£), this accounts 
for all subgroups G that lie in the normalizer of a split Cartan group and have dihedral image in PGL 2 (£). 
The total number of such G is 


— 1) — t{£ — 1) + r 




Proof. The argument that Gi and G 2 have the claimed properties is identical to that in the proof of Corol¬ 
lary 3.17, as is the argument that they are uniquely determined by H. 

The first two terms in the formula count the normal subgroups H of Gs{£) not in Z{t}, via Corollary 3.10, 
each of which gives rise to a Gi; these Gi are all non-conjugate so long as we are not in the exceptional case 
of Lemma 3.16. The last term in the formula is a correction factor for double-counting the exceptional cases. 

The third and fourth terms in the formula account for subgroups H that satisfy det(i7) = det(i7 H Z{i)) 
and —1 € H. To see this note that in the proof of Lemma 3.8, adding the restriction det(i7) = det(iL r\Z{£)) 
replaces the factor fi 2 (n) with (62 -f 1)^ and the modified formula for /3(n) is then r(n)^; using n = {(.— 1)12 
accounts for the constraint —IgH. Each such H gives rise to a G 2 , and these are all non-conjugate. □ 


Lemma 3.19. Let i be an odd prime and let G be a subgroup of Gh 2 i() with dihedral image in PGL 2 (^). 
Then G is contained in both the normalizer of a split Cartan group and the normalizer of a non-split Cartan 
group if and only if G is conjugate to a subgroup of the form 

where z € Z{i)^ is not a square, in which case the image of G in PGL 2 (£) is the Klein group of order 4. 
There is exactly one such for each odd divisor of i — 1. 


Proof. Every non-scalar element of G lies in the non-trivial coset of a subgroup of a Cartan group in its 
normalizer, hence has trace zero and order 2 in PGL2(f). It follows that the image of G in PGL2(I?) has 
order 4 , and we can write G = (51,52) with tr5i = tr52 = 0, and det 51 square, while det52 is not square. 

If (= 1 mod 4 , then after multiplication by a scalar, we can assume det 51 = — 1, and G is then conjugate 
to Hz C G+ {£) via an action that sends 51 to (0 -?i) and 52 to (° q ), with 2; = — det 52 not a square. 

If £ = 3 mod 4 , then after multiplication by a scalar we can assume det 52 = —1 and G is then conjugate 
to Hz C G+, (£) via an action that sends 52 to (0 -?i) and 51 to (° J), with z = — det 51 not a square. 

Conversely, for each non-square z G Z{£)^ the subgroup Hz lies in G+(£) nG+,(£) and has dihedral image 
in PGL2(£). If we fix a generator r for Z{£)^, the distinct groups Hz that can arise are precisely those with 
z = where e is an odd divisor of £ — I. □ 

Remark 3.20. Not every G C GL2(£) with projective image isomorphic to the Klein group is contained in 
both the normalizer of a split Cartan group and the normalizer of a non-split Cartan group; this occurs if 
and only if G contains elements 5, h with xis) = 1 and x(Ii) = — 1 . 

3 . 4 . Exceptional cases. We now consider the exceptional case ( 3 ) of Proposition 3 . 1 . In all of these cases 
the group G C GL2(£) is determined up to conjugacy by three criteria: the isomorphism class of its image 
in PGL2(£), the cardinality of its scalar subgroup Z := G H Z{£), and the index [det(G) : det(Z)]. 

Lemma 3.21. Let £> 5 be prime, and suppose that G is a subgroup of GL2(£) with projective image 
isomorphic to H G {A4,S4, A5} and scalar subgroup Z := Gfi Z{£) containing —I. 

( 3 a) If H = A4 then one of the following holds: 

(i) [det(G) : det{Z)] = 1 , 

(ii) [det(G) : det{Z)] = 3 and £=1 mod 3 with \Z{£) : Z\ divisible by 3 . 

( 3 b) If H = S4 then one of the following holds: 

(i) [det(G) : det(Z)] = 1 and £ = ±I mod 8. 

(ii) [det(G) : det{Z)] = 2 and £ = 1 mod 8 with \Z{£) : Z)] divisible by 2 . 

(hi) [det(G) : det{Z)] = 2 and £ = 3 mod 8. 

(iv) [det(G) : det(Z)] = 2 and £ = 5 mod 8 with ffZ divisible by 4 . 

( 3 c) If H = A5 then [deg(G) : det(Z)] = 1 and £ = ±I mod 5 . 

Moreover, every case listed above arises for exactly one conjugacy class of subgroups G in GL2 (£). 
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Proof. The lemma follows from the classification in [28]; see Theorems 5.5, 5.8, and 5.11. It can also be 
derived from the analysis in [1, §5.2]. □ 

The explicit classihcation of primitive subgroups of GL 2 {£) in [28] also provides a method for constructing 
a subgroup G C GL 2 (.^) that satisfies Lemma 3.21 for given values of H, Z, and [det(G) : det(Z')], whenever 
such a G exists (if it exists, it is unique up to conjugacy, by the previous lemma). The complexity of 
this algorithm is important to what follows, so we give it in detail and then bound its complexity. The 
construction given in [28] gives generators for a subgroup G of GL 2 (F^ 2 ) that is conjugate to our desired 
G C GL 2 (^); we then use the algorithm of [33] to efficiently conjugate G to G. 

Algorithm 1. Given a prime i> 5, a group H G {A 4 , S 4 , A 5 }, a subgroup Z C Z{£) containing —1 generated 
by A, and i G {1,2,3}, output generators for a group G C GIj 2 {£) with projective image isomorphic to H, 
and scalar subgroup Z <G Z{£) such that [det(G) : det(Z)] = i, or report that no such G exists. 

1. Let uj G Pp be a primitive fourth root of unity, let s := 5 (w+i -(l)+i))) s-nti let t := (0 

2. If iJ = A 4 then 

a. If f = 1 let G := (s, t, A). 

b. If z = 3 and £=1 mod 3 with 3|[Z(£) : Z] let G := where /r G Z{£) — Z satisfies = A. 

c. Otherwise, report that no such G exists and terminate. 

3. li H = S 4 then 

a. Let a G F ^2 be a square root of 2 and let m := (^ ). 

b. If z = 1 and i = ±1 mod 8 let G := (s, A). 

c. If z = 2 and £=1 mod 8 with [Z[£) : Z] even, let G := (s, ^zz. A) where ^ G Z{i) satisfies /z^ = A. 

d. If z = 2 and i = 3 mod 8 let G := (s, ^u, A) where /z G Z{i) satisfies = A. 

e. If z = 2 and i = 5 mod 8 with 4j#Z, let G := (s, ^zz, A) where ^ G Z{£) satisfies ^ 

f. Otherwise, report that no such G exists and terminate. 

4. If iJ = A 5 then 

a. If z = 1 and .^ = ±1 mod 5 then let v := j j and let G = (s,t, u, A). 

b. Otherwise, report that no such G exists and terminate. 

5. By solving a linear system in 4 variables and at most 16 equations, construct a matrix G G GL 2 (F£ 2 ) for 
which gC = Cg'^ holds for all g G G, where (cr) = Gal(F^ 2 /Ff). 

6 . Generate random matrices X G M 2 (F^ 2 ) until A := X + GX is invertible. 

7. Output G := A~^GA C GL 2 (^) and terminate. 

The last 3 steps of Algorithm 1 implement a special case of the probabilistic (Las Vegas) algorithm in [33] 
which, given a subgroup G of GLr(Fpn), hnds a conjugate subgroup G in GLr(Fpm) with m|rz minimal. 
The correctness of Algorithm 1, including the fact that a subgroup G C GL 2 (t') conjugate to G C GL 2 (F^ 2 ) 
necessarily exists, is guaranteed by Theorems 5.5, 5.8, and 5.11 of [28]. We now analyze its complexity. 

Proposition 3.22. The expected running time of Algorithm 1 is 0(M(logt') log£). 

Proof. Using standard probabilistic root-hnding algorithms we can find the roots of any polynomial of 
bounded degree over Fi or Ff 2 in 0(M(log£) \og£) expected time [32]. Every other operation in Algorithm 1 
takes 0(M(log£)) time, including the linear algebra in step 5, since the dimensions of the system are bounded. 
The expected number of random matrices needed in step 6 is at most 4; see [33, p. 1707]. □ 

3.5. Counting and enumerating subgroups. As a result of our classification we can now count the 
number of subgroups of GL 2 (^) up to conjugacy. For £ = 2 there are four non-conjugate subgroups of 
GL 2 ( 2 ), namely, Gs(2), G„s(2), B{2), and GL 2 ( 2 ) = SL 2 ( 2 ). For primes £ > 2, every subgroup of GL 2 (£) is 
conjugate to at least one of the groups enumerated on the next page. The 11 cases that appear are disjoint 
except for Gg and G„s, which intersect in Z, and Gf' and Gjjj,, which intersect in Gjpi„s. Other than these 
intersections all of the groups listed are non-conjugate in GL 2 (£). 

We thus obtain an explicit formula for the number of non-conjugate subgroups of GL 2 (£) by summing the 
formulas for the 11 listed cases with the counts for Z and Gg O G+, negated. Table 2 lists this data for odd 
primes £ < 200 along with several larger primes. These formulas can easily be adapted to count subgroups 
of SL 2 (£) instead. 22 


SL 2 : t{1 — 1 ) subgroups that contain SL 2 (^); 

B\ a(l — 1) subgroups of B{£) that contain an element of order £; 

Cs'. \{a{£ — 1 ) + I3{£ — 1 )) subgroups of Cs(£); 

Cns- t{£‘^ - 1) subgroups of C„s(f); 

Z: t{£ — 1) subgroups of Cs{£) H Cns{£) = Z{£)\ 

C+: /3(£-l)-r(£-l)+r(^^)'-r(^) -i(l + (^))r(^) subgroups of C+(£) not inC,{£)- 
(7+,: t{£'^ - 1) - t[£ - 1) + t{^^) - 'r(^) subgroups of C+^{£) not in Cns{£)] 

Ctnns'- t{{£— subgroups of Cfi£) H C'+s(^) not contained in Cs{£) or C'„s(£); 

A 4 : t(^) + i(l + subgroups G 2 SL 2 (£) with tt{G) ~ A 4 ; 

S 4 : (1 - 1(1 - (|))(1 - + 5(1 + subgroups G 2 SL 2 (£) with 7 r(G) ~ S 4 ; 

A 5 : 2(1 + (|)'r((^)) subgroups G 2 SL 2 (£) with 7 r(G) ~ A 5 . 

Remark 3.23. From the formulas for a{n) and /3(n) < a{n), and the bound r(n) = 

one may deduce that the number of subgroups of GL 2 (^) is quasi-linear in £. Indeed, the lower bound 
a(n) = 0 (n) is immediate, and the upper bound a(n) = 0 (n log log log n) is easy to prove. 

We now give an efficient Las Vegas algorithm to enumerate the subgroups of GL 2 (£) up to conjugacy. 
It outputs a short list of 0(1) generators for each subgroup and has a total expected running time that is 
quasi-linear in hence in the size of its output. 

Algorithm 2. Given a prime £, output a list of the subgroups of GL 2 (^) up to conjugacy as follows: 

1. (even £) If £ = 2 then output (), ((J 1 )), ((1 q )), (( 01 ) 1 ( 10 )) terminate. 

2. Compute a generator r for Z(£), a generator g for Cns{£), lists of the divisors of £ — 1 and £^ — 1, and a 
lookup table T := {(^( 5 ), | 7 r(( 7 )|) : g € Gs(£) U G„s(£)} indexed by u{g) := iT:{gY/ det(g). 

3. (contains SL 2 (£)) For each e dividing £ — 1 output ((0 1 ), (1 ?), (J )). 

4. (in B{£)) For each triple (a, b, i) with a, b\{£ — 1) and 0 < i < gcd(a, b), output 



where c = aj gcd(a, b) and d = n/b. 

5. (exceptional cases) If £ > 5 then call Algorithm 1 for each H G {A 4 ,S 4 ,A 5 }, i G {1,2,3}, and 

Z'= ((^” r")) dividing (£ — l)/ 2 . 

6 . (cyclic cases) 

a. (split) For each (a, 6, i) with a, b\{£ — 1) and 0 < i < gcd(a, 6), put c = aj gcd(a, h) and d= {£— l)/&, 
and if there is no integer j G [0, i — 1] satisfying jc = d — ic mod a then output 



b. (nonsplit) For each n|(£^ — 1 ) not divisible by £ -I- 1 output := (g"), where G„s(£) = (g). 

7. (dihedral cases) 

a. (split) Let 7 := ( 40 ) and d := ( q (I). For each Ha,b,i as in step 6 .a with 2ic = d mod a: 

i. Compute Za,b,i ■= Ha,b,i n Z{£) using the table T as described below. 

Unless 1 G Z(i b,i^ [Ba,b,i • Z(i b^i\ — 2, and (q G output (^H(i b,iT^'}- 

iii. If —1 G Za^b,i and det{Ha,b,i) = dei{Za,b,i) then output (iJ, 7 ^®), where e := [Z{£) : Za^b,i]- 

b. (nonsplit) Let 7 = (g _?i). For each Hn = (g") as in step 6 .b: 

i. Compute := Hn H Z{£) using the table T as described below. 

ii. Output (iL„, 7 ). 

iii. If —1 G Zn and det(iL„) = det(Z„) then output {Hmjg^), where e := [Z(£) : Z„]. 

The scalar subgroup Za,b,i '■= Ha^b,i O Z{£) computed in step 7.a.ii is uniquely determined by its order, 
which we can compute as #iLa.&,i/#7r(iLa,b.i), where tt: GL 2 (£) ^ PGL(£) is the canonical projection. 
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8 
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4 
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6 
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6 

32 

62 

2 

4 

2 

4 
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12 
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6 
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12 
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6 

32 

38 

2 

4 

2 
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4 
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48 

4 

10 

66 

2 

2 

2 

2 
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18 

2760 
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96 

18 

360 

114 

6 

20 

6 

12 
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8 
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64 

8 

52 
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4 

4 

4 

4 
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14 
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32 

14 
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30 

2 

18 

22 

0 
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9 
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72 

9 

81 

93 

3 

6 

3 

0 
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12 

1610 
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90 

12 
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6 

10 

6 

6 

2827 

10^ + 9 

30 
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10031 
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30 
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6 

40 

42 

24 

31027 

10^ + 7 

4 

25030 

12521 

60 

4 

10 

90 

2 

2 

2 

0 

37713 

10^5 + 3 

16 

715200 

357696 

128 

16 

232 

168 

8 

12 

8 

0 

1073436 

10® + 3 

8 

5000100 

2500074 

96 

8 

52 

132 

4 

6 

4 

0 

7500460 


Table 2. Subgroups of GIj 2 {i) up to conjugacy. See §3.5 for an explanation of the column headings. 
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Since T^{Ha^b,i) is cyclic, we may compute its order as the least common multiple of the projective orders of 
the generators of Ha^b,i, which may be determined using the lookup table T computed in step 2. Similar 
comments apply to computing := Hn fl Z{£) in step 7.b.ii. 

The correctness of Algorithm 2 follows from Proposition 3.1, the correctness of Algorithm 1, and the 
analysis in §3.1, §3.2, and §3.3. The constraint on i in step 6 .a ensures that we pick just one of the two 
possible conjugacy class representatives of a subgroup of C's(£), and the constraint on Ha^b,i in step 7.a.ii 
uses Lemma 3.16 to pick just one of the two possible conjugacy class representatives of a subgroup of C's(£)+ 
with projective image isomorphic to the Klein group. 

Proposition 3.24. The expected running time of Algorithm 2 is 

Proof. We hrst consider step 2. We can compute the generators r and g in (log expected time using 

probabilistic algorithms. We can compute the divisors of £ — 1 and £ + 1 in time using a sieve, and 

these lists can then be used to construct a complete list of the divisors of — 1 = 1) in time 

(here we are using the the fact that an integer n has at most divisors). To compute the table T, we 
note that for Cs{t} it suffices to compute {u{a^), {£ — l)/e) using a = (J °) for 1 < e < £ — 1 , and for Cns{£) 
it suffices to compute (rt(g®), (£ + l)/e) using the generator g for Cns{£) for 1 < e < £ + 1. Thus step 2 takes 
^i+o(i) time. 

Step 3 clearly takes time. For step 4 we note that the number of triples (a, b, i) is given by 
a[£-l)= ^ gcd(a,5) = ]^| ^ {2{vp{£ - 1) - i) + l)pA = 

a.b\{l-l) P \ 0 <i<Dp(^-l) / 

and the time to compute generators for each individual subgroup of B{£) is £°^^'>. There are £°^^^ calls 
to Algorithm 1 in step 5, each of which takes £i+“F) expected time, by Proposition 3.22. The number of 
subgroups Ha^b,i in step 6 .a is bounded by a(£ — 1 ) = and each takes £°^^ time to compute, while 

step 6 .b takes time. The number of groups arising in step 7 is similarly bounded by and the 

time for each group is (log£)^+°(^\ using the table T to compute the projective orders of i7a.b,z and as 
described above in order to determine their scalar subgroups. □ 

A Magma [11] script implementing Algorithm 2 is available from the author’s website [ 68 ]. In practical 
terms, it typically takes just a few seconds for £ k, 10 ^ and less than an hour for £ k, 10 ®, computations that 
would be infeasible using the Subgroups function in Magma, or similar functionality in GAP [30]. 

3.6. Subgroup signatures. 

Definition 3.25. For each g € GL 2 (£) we define 

sig(g) := (det(g),tr(g),dimi(g)) 

where dimi(g) G {0,1, 2} is the dimension of the 1-eigenspace of g. For each subgroup G C GL 2 (£) we define 
the signature of G to be the set 

sig(G) := {sig( 5 ) :gGG}. 

Lemma 3.26. Let I be an odd prime, and let G be a subgroup of C GL 2 (£). Then (1, 2,1) G sig(G) if and 
only if G contains an element of order £. 

Proof. If G contains an element g of order £ then it is conjugate to (g j.) and sig( 5 ^“^) = (1,2,1) G G. 
Conversely, if (1, 2,1) G sig(G) then G contains an element conjugate to (J [), which has order £. □ 

Lemma 3.27. Suppose G and H are non-conjugate subgroups o/GL 2 (£) for which sig(G) = sig{H), with 
#G > ffH. Up to conjugacy in GL 2 (£) exactly one of the following holds: 

(a) G = (G, ( g [)) and H = (G', (J [)) where G, G' C Gs(£) are distinct Gf {£)-conjugates. 

(b) G C G+(£) with det(G) C and H = G D Cs{£) C G; in this case £ = 1 mod 4. 

(c) G C G+,(£) with det(G) ^ and H = G (1 G„s(£) C G; in this case £ = 3 mod 4. 

(d) the images of G and H in PGL 2 (£) are isomorphic to A 4 and S 3 , respectively. 

For every subgroup G C GL 2 (£) there is at most one conjugacy class of non-conjugate subgroups H that have 
the same signature. 
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Proof. The four conjugacy classes of subgroups in GL 2 ( 2 ) all have distinct signatures, in which case the 
lemma is vacuously true, so we assume i is odd. The group G contains SL 2 (^) if and only if sig(G) contains 
(1, 2,1) and a triple (1, t, 0) with —4 not square, and in this case the conjugacy class of G is then determined 
by det(G), which is also determined by sig(G). The same applies to H, so this case cannot arise. Lemma 3.26 
implies that either G and H both contain an element of order i, or neither do, and if the former holds than 
we must be in case (a), by Lemma 3.6 and its proof. 

We now assume neither G nor H contain an element of order £. The scalar subgroup G fl Z(£) of G and 
the possible orders of all g £ G and h £ 7 r(G) are determined by sig(G), and they must be the same as for H. 
The groups 7 r(G) and tt{H) cannot both be cyclic, since Corollary 3.11 and Lemma 3.12 imply that in this 
case the conjugacy classes of G and H are determined by their signatures. Similarly, Corollaries 3.17, 3.18, 
and Lemma 3.19 imply that 7 r(G) and 7 r(iL) cannot both by dihedral. 

The group S 4 (resp. A 5 ) may be distinguished from any cyclic or dihedral group by the fact that it contains 
elements of order 3 and 4 (resp. 3 and 5), but no element of order 12 (resp. 15). For the group A 4 , the only 
cyclic or dihedral group with the same set of element orders is S 3 . By Lemma 3.21, the conjugacy class of 
G in GL 2 (^) with 7 r(G) isomorphic to A 4 , S 4 , or A 5 is determined by det(G) and G fl Z{i), thus the only 
case that can arise in which G ot H has an exceptional projective image is case (d) of the lemma. 

The only remaining possibility is that 7 r(G) is dihedral and tt{H) is cyclic (since we assume #G > ffH), 
and 7 r(iJ) cannot be trivial, so H is contained in either a split Cartan group or a non-split Cartan group, 
but not both. We have G H Z{i) = H f] Z{£) with G is distinguished up to conjugacy among subgroups 
with dihedral projective image by its signature and H distinguished up to conjugacy among subgronps with 
cyclic projective image image by its signature, and this implies that G must contain an index 2 subgroup 
conjugate to H. So without loss of generality we assume H = Gfl G, where G is either Gs(£) or G„s(£), and 
let jH be the non-trivial coset of H in G, for some 'j G G — H. Now tt{H) contains an element of order 2, 
since 7 r(G) does and their signatures coincide, so H contains a trace-zero element h, and every trace-zero 
element of iL is a scalar multiple of h. It follows that either all or none of the trace zero elements in H (and 
hence in G) have square determinants, depending on whether det h is square or not. 

Suppose det h is not a square. The same must be true of every element of yiL (since they all have trace 
zero), including 7 , so every element of yyiJ = H has square determinant; but this includes h, a contradiction. 
So h and every element of jH has square determinant, including 7 , and the same holds for 7777 = H and 
hence for G; thus det(G) C as claimed. 

If 77 C Cs{£) then h = (g for some x £ Z(7)^; thus det 7 = —is square only if —1 is square in 
Z(7)^, in which case 7=1 mod 4. If 77 C Cns{£) then h = (Jj for some y £ Z(7)^ with e not square; 
thus det h = —ey^ is square only if —1 is not square in Z(7)^, in which case 7=3 mod 4. □ 

We note that when det(G) is not contained in the subgroup of squares in Z(7)^ only case (a) of Lemma 3.27 
can arise, and in this case G and 77 are isomorphic, by Lemma 3.6. This yields the following corollary. 

Corollary 3.28. Let E he an elliptic curve over a number field K and let £ be a prime for which 77 nQ(^f) = 
Q (any prime if K = Qj. Then Ge{£) is determined up to isomorphism by its signature. 

To address cases (b), (c), (d) of Lemma 3.27 that may arise when det(G) C we need an additional 
datum. For any subgroup G C GL 2 ( 7 ), let 

ir^\ _ #{9 : 5 e G,tr5 = 0} 

'-#G 

denote the proportion of trace-zero elements in G. 


Lemma 3.29. Let G and H be as in Lemma 3.21 and suppose we are not in case (a). Then 

\z{G)-z{H)\ > \. 


Proof. If we are in case (b) or (c) of Lemma 3.27, then 77 lies in a Cartan group G and has index 2 in G, 
and the non-trivial coset gH of 77 in G does not intersect G. In this case every element of gH has trace 
zero, while at most half the elements of 77 can have trace zero, thus 


z{G) - z{H) 


1 + z{H) 


z{H) 


1 - z{H) 



2 


16 


2 





□ 


In case (d) we have z{G) = 1/4 and z{H) = 1/2, thus z{H) — z{G) = 1/4. 

Corollary 3.30. If G and H are subgroups of GL 2 {i) with sig(G) = sig(id) and z{G) = z{H) then either 
G and H are conjugate or case (a) of Lemma 3.27 applies. In particular, G and H are locally conjugate and 
isomorphic. 

Proof. This follows from the previous lemma and Lemma 3.6. □ 

We now give an efficient algorithm to determine a set of generators for a subgroup G of GL 2 (^) that 
satisfies sig(G) = s and z(G) = z, given the signature s = sig(G') and trace-zero ratio z = z(G') of some 
subgroup G' of GL 2 (.^). By Corollary 3.30, the group G must be locally conjugate to G'. In order to do 
this more efficiently, we note that each signature s is uniquely determined by a small subset of its triples. It 
suffices to retain a subset s of s of signatures sig((;) for g € G' that includes 

• the triple ( 1 , 2 , 1 ) if #G' is divisible by £; 

• a triple sig{g) for which (det( 5 )) = det(G') =: det(s); 

• a triple sig(g) for which (g) = Z{G') =: Z{s)] 

• a triple sig{g) for which | 7 r(si)| = max{| 7 r(h)| : h G G'} =: m(s); 

• triples sig(gi) for which lcm| 7 r(( 7 i)| = lcm{| 7 r(/i) : h G G'} =: A(s); 

• triples sig( 5 r,) for which {x(gO} = {x(^) ■- h G G'} =: x(s); 

• if 7 r(G') is not cyclic, triples sig(gi) and sig( 52 ) with | 7 r(gi)| = ^( 52 )! = 2 but 7 r(gi) ^ 7 r(g 2 ). 

Given any signature s = sig(G') we can always reduce s to a subset s of at most 11 elements that 

satisfy all of the criteria above. Alternatively, as we shall do in Section 5, we can construct s by randomly 
sampling a sufficiently large subset of s, without ever needing to store more than 0 (log£) triples, which 
requires just 0(log^ £) bits of space, as opposed to 0(£^log£) for the entire signature. More importantly, 
with the algorithm below we can obtain generators for a subgroup G locally conjugate to G' in expected 
time polynomial in log£ rather than £, an exponential improvement. For any subgroup G of GL 2 (£) let 
Z(G) denote the subgroup of scalar elements, and similarly let Z(s) denote the subset of signatures of scalar 
elements (d, t, n) with n G {0, 2} and t^ — 4d = 0. 

Algorithm 3. Given a subset s of the signature s of a subgroup G' of GL 2 (^) satisfying the requirements 
above and a rational number z G [0,1] with denominator at most #GL 2 (£) satisfying |z(G') — z| < 1/8, 
output a set of generators for a subgroup G of GL 2 (^) that is locally conjugate to G' as follows: 

1. (even £) If £ = 2 then output G = ((J ?)), ((?J)), ((] |^)), or (( ? J), (] J)) when s is equal to {(1,0, 2)}, 
{( 1 , 0 , 2), (1, 0 ,1)}, {( 1 , 0 , 2), (1, 1 , 0 )}, or {( 1 , 0 , 2), (1, 0 ,1), ( 1 ,1, 0 )}, respectively, then terminate. 

2. (cases with order divisible by £) If s contains the triple (1, 2,1) then: 

a. (contains SL 2 (^)) If —1 G x(s) output G = (((j }), (} ? ), (0 [])) with (d) = det(s) and terminate. 

b. (in B{£)) Output G = ((0 ]) c) C B{£), with g G Gs(£) satisfying | 7 r(g)| = m(s) and (c) = Z(s), 
and terminate. 

3. (exceptional cases) Gheck for projective image A 4 ,S 4 , A 5 as follows: 

a. (A 4 ) If z < 3/8, m(s) = 3 and A(s) = 6 , use Algorithm 1 to construct G with 7 r(G) ~ A 4 , Z(G) = Z(s), 
and [det(G) : det(Z(G))] = [det(s) = det(2'(s))]. Output G and terminate. 

b. (S 4 ) If m(s) = 4 and A(s) = 12 use Algorithm 1 to construct G with 7 r(G) ~ S 4 , Z(G) = Z(s), and 
[det(G) : det(2'(G))] = [det(s) = det(Z(s))]. Output G and terminate. 

c. (As) If m(s) = 5 and A(s) = 30 use Algorithm 1 to construct G with 7 r(G) ~ A 5 , Z(G) = Z(s), and 
[det(G) : det(2'(G))] = [det(s) = det(Z(s))]. Output G and terminate. 

4. (trivial cases) If x(s) = {0} output Z(s) and terminate. 

5. (cyclic cases) Gonstruct a maximal H C Gs{£) U Gns{£) with 7 r(iJ) cyclic such that sig(iL) C s: 

a. Let (c) = Z{.s) let g G Gs{£) U Gns{£) satisfy | 7 r(g)| = m(s) and sig)^) G s, and set H = (g, c). 

b. If s C sig(iL) and |z(iL) — z| < 1/8 then output G = H and terminate. 

6 . (dihedral cases) Determine the unique G fj H with 7 r(G) dihedral such that sig(G) = s: 

a. Let e = [Z{£) -. H Z{£)\, where H is as in step 5. 

b. If xid) = 1 let 7 = (5 J) and r = ( q °), otherwise let 7 = (0 -?i) and let r be a generator for Gns{£). 

c. Output whichever of G = (i?, 7) or G = (iL, 7r®) satisfies s C sig(G). 
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The correctness of Algorithm 3 follows from Proposition 3.1, Lemma 3.26, and Corollaries 3.17, 3.18, 
and 3.30. Note that in the dihedral case s is guaranteed to contain the signature of some h G G — H, 
since we retain two projectively distinct elements of order 2 in this case, and det h will determine whether 
det(G') = — det(G — i7) or not, which determines which of the two possible subgroups G to output in step 6c, 
by Corollaries 3.17 and 3.18. 

Proposition 3.31. The expected running time of Algorithm 3 is 0(M(log£) log£). 

Proof. All the individual arithmetic operations in the algorithm involve 0(log£)-bit integers, including the 
numerator and denominator of z, and can be accomplished using 0(M(log£) log log £) bit operations (includ¬ 
ing any field inversions). The subset s contains just 0(1) elements, there are 0(1) steps in the algorithm, 
and each can be completed in 0(M(log£) \og tj expected time, including the calls to Algorithm 1, by Propo¬ 
sition 3.22, and the time to obtain a generators e for Z{£)^ and r for Cne{£) using a Las Vegas algorithm. □ 

3.7. Locally conjugate subgroups. We conclude this section with a theorem that precisely characterizes 
the circumstances in which we may have an elliptic curve E/K for which Ge{£) is locally conjugate but not 
conjugate to another subgroup of GL 2 (£). 

Theorem 3.32. Let £ be a prime and let E he an elliptic curve over a number field K for which there exists 
a subgroup G' of 0112(£) that is locally conjugate to Ge{£) but not conjugate to Ge{£). Then G' arises as 
Ge'{£) for an elliptic curve E' jK that is related to E by a cyclic isogeny whose degree is a power of £; the 
curve E' is unique up to isomorphism. 

Proof. It follows from the classification of §3 that up to conjugacy, G = Ge{£) and G' are of the form 
G = H yi {t) and G' = H' y ft ), where t = ( q j) and H and H' are distinct subgroups of Gg (£) that are 
conjugate in GL 2 (^) via (i J). This implies that neither JI nor H' lie in Z{i). 

The group G lies in B{£) but not Gs{£), so E admits a rational isogeny (pi of degree £ that is unique up 
to isomorphism. Let Ei = pi{E) and let Gi = Ge^{£). The isogeny pi induces a homomorphism G —>■ Gi 
with kernel ft). The existence of the dual isogeny implies that the order of Gi is either equal to that of G 
or smaller by a factor of £ (it cannot be larger because £‘^ does not divide ffGl 2 {£)). In the latter case, Gi 
lies in a split Cartan group but is not contained in Z{£) (since H is not), and Ei admits exactly two distinct 
rational Gisogenies, one of which is the dual of pi. 

If we let p 2 '. El ^ E 2 be the rational Gisogeny that is not dual to pi and put G 2 = Ge^ W, then either G 2 
also lies in a split Cartan group but not Z(£) and we can repeat the same argument, or G 2 has the same order 
as G. The isogeny class of E is finite, so by following a chain of Gisogenies whose composition p has a cyclic 
kernel of Gpower order, we must eventually reach an elliptic curve En = Pn{E) for which Gn ■= GEr^i£) has 
the same order as G. We may thus assume that Gn lies in B{£) but not Cs{£), and therefore has the form 
Hn X ft), where Tin is a subgroup of Gs{£). The isogeny pn induces a group homomorphism fn'. G ^ Gn 
with kernel ft). We can pick bases {P,Q) and {P',Q') for E[£] and En[£] (respectively) so that Pn{P) = 0 
and Pn{Q) = Q' , while for the dual isogeny pn we have Pn{Q') = 0 and pn{P') = P. It follows that fn 
restricts to an isomorphism from H to Hn that corresponds to conjugation by (5 J) (swapping the diagonal 
elements). We therefore have = H' and G„ = G' . The curve E' := En is determined up to isomorphism 
by the kernel of the separable isogeny pn, which is in turn determined up to isomorphism by E. □ 

Remark 3.33. The theorem allows for the possibility that E/K has CM, but rarely applies in this case. 
When E/K has CM the hypothesis of the theorem is satisfied only when when £ is ramified in the CM 
field and the ideal above £ in the CM field is non-principal (and thus has order 2 in the class group). This 
corresponds to an .^-volcano that consists of a single edge; see [66]. 

Example 3.34. Consider the chain of 5-isogenies E i —>■ Ei ^—>■ E', where E, Ei, E' are the elliptic 
curves over Q with Cremona labels lla3, llal, lla2, respectively. In this example the groups G = ((J 2 )) 
and H = ((g ?)) are both conjugate to G_Bj( 5), while the groups G£;(5) = {G,t) and Ge'{ 5 ) = {H,t) are 
non-conjugate but locally conjugate and isomorphic (as required by Lemma 3.6). As can be seen from the 
groups Ge( 5) and G£;'(5), the elliptic curve E has a rational 5-torsion point, but E' does not. 
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4. GRH Bounds 


By the generalized Riemann hypothesis (GRH) we refer to the assumption that the non-trivial zeros of 
the Dedekind zeta function of a number field all lie on the critical line {s G C : Re(s) = 1/2}. We also recall 
the logarithmic integral Li(a:) := dt/logt. 


Proposition 4.1 (Lagarias-Odlyzko, Serre). Assume the GRH. Let L be a finite Galois extension of a 
number field K with Galois group G = G&\{L/K), let nr '■= [L : Q], and := |disc(L)|. For each 
nonempty subset C of G stable under conjugation define 

(L/K\ 


T^c{x) := # 




p j 


c c, N{p) < X 


where p ranges over the primes of K that are unramified in L, N{p) is its absolute norm, and 
Artin symbol. There are absolute effective constants ci and C 2 such that 




the 


T^c{x) - 


< Cl v^(log dh + UL log x) 


holds for all x > 2, and TTcix) > 1 for all x > C 2 log^ 


Proof. The first bound is [59, Thm. 4], which sharpens [38]. The second is [59, Thm. 5], which is also 
sketched in [38]. For the third bound, see the remark regarding an improvement to Corollary 1.2 in [38]. □ 

Remark 4.2. As noted in [59], Oesterle announced the explicit values Ci = 2 and C 2 = 70 in [51]. Proofs 
of these values have not been published, but in [72] one can find proofs that use somewhat larger constants 
(one can take ci = 185 via [72, Thm. 1.2]; if one assumes dz, is sufficiently large one can take ci ~ 32). 

Proposition 4.3 (Larson-Vaintrob). Assume the GRH. Let E be an elliptic curve without CM defined over 
a number field K, and let Ne be the absolute value of the norm of its conductor. There is an effective 
constant ck depending only on K such that Gz;(£) GL 2 (f) only occurs for primes 

i<CK logNsiloglogNEf. 


Proof See [42, Thm. 2]. 


□ 


Remark 4.4. Without the GRH the best known bounds on £ are exponentially worse. Even in the case 
K ~ Q the best unconditional bound known is quasi-linear in Ne [18]. For elliptic curves over Q with 
no primes of multiplicative reduction, an 0{i/Ne) bound is given in [73], which also gives much stronger 
bounds (logarithmic in the discriminant) for elliptic curves with non-integral /-invariants. 


Proposition 4.5. Let E be an elliptic curve defined over a number field K, and let Ne be the absolute value 
of the norm of the conductor of E. Let m > 1 be an integer, let L := K{E[m]) be the m-torsion field of E, 
and let dz := | disc(L)|, dx ■= \ disc(Ar)|, and uk ■= [K : Q], Then 

logdi < m'^dzf (4 ?t,zc log 2 m + dx + P) \og{mNE). 


Proof. We have 

d-L = d^x^^\d^K/Q(,dL/x)\, 

where d^/zf denotes the relative discriminant of L/AT. The extension LjK has degree at most #GL 2 (m) 
which is less than m^, and is unramified at all primes p oi K that do not divide m and for which E has 
good reduction; see [25, Thm. 1]. The ramification index e of any prime q|p cannot exceed [L : K\ < nrA, 
therefore the multiplicity of any prime q in the relative different Pe/k cannot exceed 

e — 1 -I- Vp{e)e < e{nx log 2 e -I- 1) < m‘^{4:nx log 2 m -I- 1) =: B. 

The multiplicity of any prime p in the relative discriminant dL/x = l/ xiP l/k) is also bounded by B, and 
since every ramified prime divides mNx, we have 


Thus 


\Nx/ci{dL/x)\ < mNE- 

log di < m*dx + B log(mAz;) = m‘^{‘inx log 2 m + dx + P) \og{mNE). 


□ 
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Remark 4 . 6 . The conductor norm Ne can be replaced by its squarefree part in the proposition above. 


Corollary 4.7. Assume the GRH. Let E be an elliptic curve defined over a number field K and let Ne be 
the absolute value of the norm of its conductor. Let i be a prime and let L = K{E[£]). There is an effective 
constant c'^ depending only on K such that every conjugacy class in Ge{£) arises as the image of a Frobenius 
element of Gal{L/K) for a prime p f £ of good reduction for E with absolute norm N{p) < x, provided that 

X > CE£^ifog£\og{lNE)Y■ 

For £ < cji^ogNEifoglogNE)^ as in Proposition 4 .3, it suffices to have 

X > c';f(logiVi5)^°(loglog7V£;)'‘(logloglog7Vi5)2'‘, 

Moreover, if a good prime p )( £ is chosen uniformly at random from the set {p : iV(p) G [P,2P]} with 
P > a; log log a; and x as above, then for any nonempty subset C of Ge{£) stable under conjugation the 
probability that Frobn lies in C is 

where the implied constant in o(l) is effective. 

Proof. Applying Proposition 4.5 with n = £ yields logdi = 0{£* \og£\og{£NE)), where the implied constant 
is effective and depends only on K. We then apply the last part of Proposition 4.1 to get the first lower 
bound on x. The second bound on x follows immediately, and the last statement follows from the upper and 
lower bounds on ttc{x) given by Proposition 4.5 (we just need P to grow strictly faster than x). □ 

Remark 4.8. Analogous results that do not depend on the GRH are known (see [38] and [39], for example), 
but the bounds are typically polynomial in the absolute discriminant rather than its logarithm. 

5. Algorithms and Applications 

All the fields k that we shall consider are either number fields K or finite fields of odd characteristic p; 
in both cases fc is a finite extension of its prime field fco and can be explicitly represented as kQ[a\/{F{a)) for 
some fixed monic polynomial F G Z[a] of degree [k : fco] whose image in fco [a] is irreducible. For the purpose 
of explicit computation, we assume that elements of fc are uniquely represented as integer polynomials of 
degree less than [fc : fco], with coefficients in the interval [0,p — 1] in the case that fco is the finite field Fp. 

For number fields K = Q[a]/(F(Q!)), we assume that the polynomial F is fixed in advance, and that 
elliptic curves E/K are specified by an integral Weierstrass equation = f[x), where / G Z[a][a;] is a cubic 
polynomial whose coefficients in Z[a] represent elements of K as described above. For each prime p of A"/Q 
that does not divide disc(F) we may represent the residue field Fp of p as Fp[Q!]/(G(a)), where p = p fl Z 
and G divides the image of F in Fp[Q!]; such a G can be efficiently obtained by factoring F over Fp (indeed, 
this is how the p\p are typically determined; see [17, §4.8.2], for example). If p is a prime of good reduction 
for E, we may compute E^ := E mod p by reducing the Z[Q;]-coefficients of f{x) modulo [p, G(a)) to obtain 
elements of Fp. 

Remark 5.1. We do not assume Ok = Z[a] (which is possible only when Ok is monogenic), so disc(F) 
may be divisible by primes that do not divide disc(Ar). Such primes p are finite in number and there is no 
harm in ignoring them for the purpose of computing Ge{£)- More generally, as we are only interested in 
primes p of bounded norm, there is no loss of generality in assuming that iV(p) = p is prime, so that we have 
deg G = 1 and Fp ~ Fp; this accounts for all but a negligible proportion of the primes p with A^(p) < B for 
any sufficiently large bound B. Doing so simplifies the practical implementation of our algorithms. 

5.1. Computing Frobenius triples. Our strategy is to determine the signature of Ge{£) by computing 
the images of Frobenius elements Frobp under pE,g for primes p of good reduction for E that do not divide £ 
or disc(F) (such primes are unramified in both K{E[£])/K and K/Q). This requires us to compute the 
determinant, trace, and 1-eigenspace dimension of (Frobp). If we put q := A^(p), then for any prime £ 
not divisible by p, the Frobenius triple 

(3) (detps,^(Frobp), tr(Frobp), dimi(p£;,£(Frobp)) 
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oi E/K ai p \s given by 

(gmod£, tr mod £, log^ #£;p[^](rp)), 

where tiTTE^ := g + 1 — #i?p(Fp) is the trace of the Frobenius endomorphism tte^ of Ep. We can efficiently 
compute tr using Schoof’s algorithm [55, 56], which runs in time (log (see [60, Cor. 11] for a sharp 

bound when q is prime; up to factors of log log g, the non-prime case is the same). To compute #£^p[^](Fp) 
we rely on Miller’s algorithm [49] for computing the Weil pairing. Recall that for an elliptic curve E over 
any field k any prime i ^ char(fc), the Weil pairing 

UJI : E[e] X E[e] ^ 

is a non-degenerate alternating bilinear pairing. This implies that for any P,Q G E\i] ~ Z(£) x Z(^), the 
points P and Q generate E[P\ if and only if uJi{P,Q) ^ 1. In [49], Miller gives an efficient algorithm to 
compute ujf, when fc = F^ is a finite field and P, Q lie in £'(Fg) it runs in time (logg)^“''°^^^. 

We now give a Las Vegas algorithm to compute Frobenius triples for a set S of primes £ for a given 
reduction Ep oiE jK at an unramified prime p of norm q. The algorithm can be applied to any elliptic curve 
over a finite field, but in order to keep the context clear we denote the curve i5p/Fp, since we have in mind 
a reduction of our fixed elliptic curve E/K. 

Algorithm 4. Given an elliptic curve Ep over a finite field Fp of characteristic p and cardinality q, and a 
finite set S of primes l^p, compute T = {(£, q mod £, tr-Tr^ mod £, log^ #£lp[£](Fp)) : £ G as follows: 

1. Use Schoof’s algorithm to compute t = q + 1 — ^Ep{Fp) and put N := q + 1 — t. 

2 . Initialize T to {} and for each prime £ G S: 

a. Put e := v^^N). 

b. If e = 0 then add (£, q mod £, t mod £, 0) to T and proceed to the next prime £ G S. 

c. If e = 1 or g ^ 1 mod £ then add (£, q mod £, t mod £, 1) to T and proceed to the next prime £ G S. 

d. Repeat the following: 

i. Generate random points Pi,P 2 G £’p(Fp) and compute Qi := {N/£^)Pi and Q 2 '■= {N/£^)P 2 . 

ii. For f = I, 2, determine the least G [0, e] such that £‘^‘Qi = 0. 

iii. If max(ei, 62 ) = e then add (£, q mod £, t mod £, 1) to T and proceed to the next prime £ G S. 

iv. Use Miller’s algorithm to compute C := ^i{£^^~^Qi,£^'^~^Q 2 )- 

V. If C 7 ^ I then add (£, g mod £, t mod £, 2) to T and proceed to the next prime £ G S. 

3. Output T and terminate. 

Steps 2.b and 2.c of the algorithm allow us to quickly treat cases where we can immediately determine 
the £-rank r := log^ #Up[£](Fp): if £ does not divide N = :^Ep{¥p) (so e = 0), then clearly r = 0; if £ divides 
N then r > I, and we can have r > I only if £^ divides #ifp(Fp) (so e > 1) and g = I mod £. 

Proposition 5.2. The expected running time of Algorithm 4 

o((logg)5+°W+#5-(logg)3+°(i)). 

Proof. As noted above, the cost of running Schoof’s algorithm in step 1 is bounded by (logg)®+°(^^. Gen¬ 
erating uniformly random non-trivial points P G Ep{Fp) in step 2.d.i can be accomplished by repeatedly 
choosing uniformly random xq G Fp and attempting to find a root yo of — /(xq) G Fp[y]; to obtain a 
uniform distribution over Up(Fp) — { 0 } one picks the sign of yo at random and discards points with yo = 0 
with probability 1/2. The expected time per random point (xo,yo) is (logg)^“''°*'^\ which matches the cost 
of step 2.d.ii. The time for step 2.d.iv is (log and this dominates the total cost of step 2.d, which we 

expect to execute less than twice, on average, for each £ G S'. If Up(Fp)[£] has order £, then with probability 
at least 1 — I/£^ one of Qi or <52 will be a generator and the algorithm will then proceed to the next £ G S 
in step 2 .d.iii; otherwise we have £'p[£] C Up(Fp), and with probability at least 1 — l/£ the points Qi E^nd 
Q 2 generate Ep[£\ and the algorithm proceeds to the next £ G S in step 2.d.v. The expected time for step 
2.d is thus (logg)^+°(^i for each prime £, and the total time for step 2 is #S • (log □ 

Remark 5.3. By using the Schoof-Elkies-Atkin (SEA) algorithm in step 2 of Algorithm 4, under the GRH 
one obtains a tighter bound on its average running time for reductions of a hxed elliptic curve E/K modulo 
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primes p of K with norm contained in any dyadic interval [x, 2a::]. An extension of [60, Cor. 3] yields an 
average expected time of 

O ((logx)4+°(i) + #5 • (logx)3+°(i)) 

per prime. This also applies if we restrict to degree-1 primes, or to primes in an arithmetic progression with 
a sufficiently small modulus. 


5.2. Computing Frobenius conjugacy classes. We now give an asymptotically slower algorithm that 
instead of computing Frobenius triples for a given set of primes computes a single integer matrix 


_ / (up “f bpSp^/2 

P {bp{Ap-Sp)/4 


(Op 


bp \ 

— bpSp)/2j 


G M2(Z) 


whose reduction modulo m lies in the conjugacy class PE,m(Frobp) for all integers m > 1 prime to p (including 
all primes i not divisible by p). The quantities Op, bp, Ap, 5p appearing in Ap are defined as follows. Let Rp 
be the subring of End(£'p) generated by tte^ ] if G Z then i?p = Z and otherwise Rp is an order in an 
imaginary quadratic field. We then define 


Ap := disc(i?p), (5p := 0,1 as Ap = 0,1 mod 4, ap:=tTTTEf, 


bp := ^(a2-47V(p))/Ap. 


Note that 6p = 0 if i?p = Z (and in this case Ap is a scalar matrix), otherwise bp is the index of 
in Rp. In either case, we always have 

4A(p) = a^ -fe^Ap, 

with tr Ap = Op and det Ap = N{p) ^ 0. 


Theorem 5.4 (Duke-Toth). Let E be an elliptic curve over a number field K and let p be a prime of good 
reduction for E. For any integer m for which p f m is unramified in K{E[m\) the reduction of Ap modulo m 
lies in the conjugacy class of pE,m(PT^obp) in GL 2 (m). 


Proof See [25, Thm. 2.1]. 


□ 


When Ep is supersingular, the matrix Ap is determined by A^(p) and Op. This follows from the fact 
that in this case End(i?p) is a maximal order in the quaternion algebra End(E) 0 Q, by [22], hence either 
i?p = Z or Rp is the maximal order of Q{y^—p), where pjp. In the former case 6p = 0 and in the latter case 
Ap = disc(Q(i/^)) and bp = (op - 4A(p))/Ap. 

To treat the ordinary case, we rely on the algorithm in [8], which gives a GRH-based Las Vegas algorithm 
to compute the index Up of End(Ep) in the maximal order of the imaginary quadratic field End(£'p) 0 Q 
with an expected running time of 

L(iV(p))i+°(i), 

where 

L(x) := exp y^logxlog logx. 

The first step of this algorithm is to compute Op via School’s algorithm and factor — 4V(p) in order to 
determine the discriminant D := disc(Q((ap — 4A(p))^/^). Once the index Up has been determined we may 
compute bp = (op — 4V(p))/(itpi4). This yields the following theorem. 

Theorem 5.5. Let E he an elliptic curve over a number field K and let p be a prime of good reduction 
for E. Under the GRH there is a Las Vegas algorithm to compute Ap in L(A(p))^“''°(^^ expected time. 

Remark 5.6. An exponential-time algorithm for computing Ap using Hilbert class polynomials Hd whose 
discriminants D divide — 4V(p) is given in [15]; the running time is not explicitly analyzed in [15], but 
we note that there are several algorithms to compute Hilbert class polynomials whose running times are 
quasi-linear in \D\, which is close to the bit-size of He [7]. The fastest of these relies on the GRH [64], but 
the algorithm in [27] does not, and as noted in [62, Rem. 1.1], the heuristics used in [27] can be removed. 
This gives an unconditional deterministic algorithm to compute Ap in time N but this is too slow 
to be useful to us here (and we require the GRH in any case). 
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In terms of its complexity in q = N{p), the subexponential-time algorithm to compute Ap is much slower 
than Algorithm 4, which computes the Frobenius triples (detAp mod-f, trAp mod£, dimi(Ap mod ^)) for 
primes £ G S' in time polynomial in logg. However, when S is large (say on the order of (log 
and q is relatively small (say logg is polynomial in log Ne), the running times are essentially the same, and 
computing Ap gives us more information; in particular, it allows us to distinguish the conjugacy classes of 
(g °) and {qD in GL 2 (£) even when a; ^ 1, which is not possible with just the Frobenius triple; We shall 
make use of this in §5.4 

5.3. A Las Vegas algorithm. We now give a Las Vegas algorithm to compute Ge{(-) up to local conjugacy 
for all primes £ up to a given bound L by computing images of Frobenius elements Frobp with A (p) up to a 
given bound P. Using the GRH-based bounds of Section 4 to determine L and P yields an algorithm whose 
expected running time is polynomial in log ||/||, where j/^ = f{x) is an integral defining equation for E/K 
with / £ Z[Q;][a;] and ||/|| is the maximum of the absolute values of the norms of the Z[Q;]-coefficients of / 
(which may also be dehned in terms of the integer coefficients of / and disc(F), where K = Q[a]/(F(Qf))). 

Algorithm 5. Given an elliptic curve E-. = f{x) over K = Q[a]/(F(a)) with integral coefficients and 

bounds L and P, compute for each prime £< L a. group Gg C GL 2 (£) that is locally conjugate to a subgroup 
of Ge{£) and contains a representative of p£;_^(Frobp) for all primes p of AT prime to £disc(F) and of good 
reduction for E with N{p) < P as follows: 

1. Let S be the set of primes i < L, and for each i G S initialize the quantities sg G- {}, eg ^ 0, zg G- 0. 

2. Compute the norm A^; £ Z of the discriminant of E and the discriminant c?f £ Z of the polynomial F. 

3. For each rational prime p < P that does not divide Ae or (Ie' 

a. Factor F{a) mod p into irreducible Gi(q;), ..., Gr(a) £ Fp[Q!]. 

b. For each Gi with deg Gi < logP/ logp: 

i. Use Algorithm 4 to compute the Frobenius triples 

Tg^p := (detp_B_^(Frobp), tr (Frobp), dimi (Frobp)) 

for the prime p of AT with residue field 'Fp[a]/Gi{a) and each prime £ G S — {p}. 

ii. For each prime £ G S — {p} update sg sgA {xg^p} and eg eg + 1. 
ill. If trp£;/(Frobp) = 0 then update zg zg + 1. 

4. For each prime £ G S, use Algorithm 3 to construct generators for a subgroup Gg of GL 2 (t) with 
sig(Gf) = sg and \z{Gg) — zgleg\ < 1/8 (if Algorithm 3 fails, report that P is too small and terminate). 

5. Output the groups Gg (specified by generators) and terminate. 

Failure in step 4 can conceivably occur if sg and zgjeg do not actually correspond to a subgroup of GL 2 (.^), 
in which case the input to Algorithm 3 is invalid and this may cause it to fail (an event that can be easily 
detected), even though it is guaranteed operate correctly on all valid inputs. This could happen if P is too 
small for every conjugacy class in Ge{£) to be realized as the image of Frobp with A(p) < P. The bounds 
in Section 4 allow us to choose P so that such a failure would disprove the GRH. 

Theorem 5.7. Assume the GRH and let K = Q[a]/(P(a)) he a fixed number field. There is a Las Vegas 
algorithm that, given an elliptie curve E/K in integral form y'^ = f{x) with f G Z[Q;][a;] that does not have 
complex multiplication, determines for every prime £ a subgroup Gg C GL 2 (^) locally conjugate to Ge{£). 
The algorithm outputs a bound L for which Ge{£) = GL 2 (£) for all primes £ > L, and a list of generators 
for Gg for each prime £ < L. The expected running time of the algorithm is bounded by 

(log||/||)''+°«. 

Proof. Under the GRH, Proposition 4.3 guarantees that we have Ge{£) = GL 2 (^) for all primes £ larger 
than c_R-(log A£;)(loglog A^;)^, where the constant ck is effective and Ne is the absolute value of the norm 
of the conductor of E. By Ogg’s formula [50], Ne is bounded by the norm of the discriminant of E, 
which can be expressed as a polynomial of bounded degree in terms of the coefficients of /. It follows that 
log As = 0(log ll/ll), where the implied constant is effective and depends only on K. We may thus take 
L = (log 11/11)^^°^^^ as a bound on the primes £ that we need to consider. 
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Since K is fixed, we have degi^ = 0(1) and logg = O(logp), and all the integers and finite field elements 
that arise in the algorithm have O(logp) bits. Using fast arithmetic, we can assume the cost of each 
arithmetic operation in Z, Fp, Fp is (logp)^“''°^^^; see [32], for example. Using the Cantor-Zassenhaus 
algorithm [14], step 3a takes 0((logp)^+°(^)) expected time, by [32, Thin. 14.14], and the time to reduce E 
to Ep is (log The time for step 3b is 0((logp)^“''°*^^^); this follows from [60, Cor. 11], which also 

applies to the constant degree extension Fp/Fp. 

For the bound P, Corollary 4.7 implies that we can take P = (log where the implied constants 

are again effective. Note that by Lemma 3.29, we only need to determine z{G{E)) to within e < 1/8. The 
running time of step 3 of Algorithm 5 is then bounded by 

(log ||/|1)1°+°(1) ((log ||/||)1+°(1) + (logP)5+°(i)) = (log 
which dominates the cost of the other steps, including the time to determine the primes £ < L and p < P. □ 


5.4. A Monte Carlo algorithm. We now give a more efficient Monte Carlo algorithm to solve the same 
problem. Although it has a negligible impact on the worst-case asymptotic complexity that we can prove 
under the CRH, for practical purposes it is better to split the problem into two stages: (1) determine 
the primes £ for which Ge{£) ^ G'L 2 {£), and ( 2 ) compute Ge{£) up to local conjugacy for each of these 
primes. If one assumes that Serre’s question has an affirmative answer, meaning that the largest £ for which 
Ge{£) ^ G'L2{£) is bounded by a constant depending only on K, then the exceptional primes £ are bounded 
by 0(1) for any fixed K, but we do not want the correctness of the algorithm to depend on this, so we 
will typically consider many more primes £ in stage (1) (up to the GRH bound given by Corollary 4.3) 
than in stage ( 2 ). The key difference is that if Ge{£) = GL 2 (t), we can unequivocally determine this after 
computing the image of just 0(1) random Frobenius elements, whereas computing Ge(£) Si Gli2(£) up to 
local conjugacy requires us to compute the image of 0(£) random Frobenius elements in the worst case. 

Proposition 5.8. Let £ > 7 be prime. A subgroup G of GL 2 (F^) contains SL 2 (F£) if and only if it contains 
elements 51 , 32,33 with nonzero trace such that 

(1) X( 3 i) = +1; 

(2) x(32) = -1; 

(3) ulgs) ^ {1,2,4} and u{gzY ~ ^^( 33 ) + 1^0 {equivalently, 3 I ^ Z{£) for e < 5). 
where xig) = ( ^dg) - 4 det(g) ^ ^ ( 0 , ± 1 } and u{g) = ir{gY/ dLei{g) e F^. 

Proof. The reverse implication appears in [58, Prop. 19] and follows from Proposition 3.1; (1) and (2) 
together imply that no conjugate of G lies in Gf'{£), G^^(£), or B{£), and (3) rules out the exceptional cases. 
Conversely, for .£ > 7 there exist 31 , 32,33 S SL 2 (F£) satisfying conditions (1), (2), (3), respectively. □ 


Up to constant factors the following proposition is implied by [37, Thm. 5.1] (and its proof), but here we 
give a slightly more precise statement. 


Proposition 5.9. Let £ > 7 be prime and let G be subgroup of G'L 2 {Fi) containing SJj 2 {Fi). Let Xi,X 2 ,... 
be a sequence of independent random variables uniformly distributed over G. Let X be the integer random 
variable for which the event X = r occurs if r is the least integer for which {Xi ,..., X^} include 31 , 32,33 
of nonzero trace that satisfy the three criteria of Proposition 5.8. The expected value E[A] of X satisfies 
E[A] < 8 , and E[A] —>■3 as £ ^ 00 . 


Proof. We consider the waiting times for each of the conditions (1), (2), (3) in Proposition 5.8 to be satisfied. 
From Table 1 we see that SL 2 (Ff) contains {£ — 1){£'^ + £)l‘2 elements 31 for which x( 3 i) = +1, of which at 
most £'^ + £ have trace zero. The same is true of every coset of SL 2 (Ff) in G; applying #SL 2 (F£) =£? — £ 
yields 


#{3 e G : x( 3 ) = l,tr( 3 ) 7 ^ 0} ^ £ - 3 


> 


as 


£ —>• 00 , 


#G - 2£-2 2 

and we note that the LHS is never less than 2/5 for £ > 11. A similar argument shows that 


#{3 e G : x(3) = -l,tr(3) 7^ 0} > ^-3 
#G - 2£+2 
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2 


as £ —>■ 00 , 







and the LHS is at least 1/3 for i > 11. The events represented by these ratios are disjoint, so with 
probability approaching 1 as £ —oo, one of them occurs for Xi, and the expected waiting time for both to 
occur approaches 3 as £ —>■ oo. 

The images of Cs(^) H SL 2 (F£) and C'„s(£) fl SL 2 (F£) in PSL 2 (Ff) are cyclic groups of order (i — l )/2 
and [I + l)/2, respectively, and the same applies to their conjugates. In each of these groups there are only 
10 elements of order at most 5, hence these occur with probability approaching 0 as oo. Switching to 
a coset of SL 2 (Ff) and considering images in PGL 2 (Ff) can only decrease the probability of getting an 
element of order at most 5. On the other hand, every g G G with xid) = lies in a conjugate of Cs{i) or 
Cnsi^), and we have already noted that the probability that Xi is such an element approaches 1 as £ —>■ oo. 
Thus with probability approaching 1 as £ —>■ oo, condition (3) is satisfied by Xi and this implies E[X] —3. 

A direct calculation shows that for £ > 7 the probability that Xi satisfies both conditions (2) and (3) is 
never less than 1 / 6 , and since ( 1 ) and ( 2 ) are disjoint, the expected waiting time for either ( 1 ) or both ( 2 ) 
and (3) to be satisfied is bounded by 30/17 < 2, and this implies E[A] <2 + 6 = 8 . □ 

For £ < 7 we rely on the following proposition. 

Proposition 5.10. Let G be a subgroup o/GL 2 (£). For I = 2 the group G eontains SL 2 ( 2 ) if and only if 
it contains 51,52 with tr( 5 i) = 1 and dimi( 52 ) = 1. For £ > 2 the group G contains SL 2 (£) if and only if it 
contains 51,52 with x{ 9 i) = “I? xid^) = 0 and dimi(52) = 1. 

Proof. The case £ = 2 is easily checked, so we assume £ > 2. For the “if’ direction, we note that the criteria 
for 5 i ensure that G is not contained in a Borel group or in the normalizer of a split Cartan. For £ > 5 the fact 
that 52 has projective order divisible by £ rules out exceptional subgroups, and for £ = 3,5 every exceptional 
subgroup containing an element of order £ also contains SL 2 (£). For the “only if’ direction, we note that 
SL 2 (£)nC'„s(£) has order £+1 and thus contains a non-scalar element 51 with xidi) = and SL 2 (£)ni?(£) 
has order divisible by £ and contains a non-scalar element 52 with xid^) = 0 and dimi( 52 ) = 1 . □ 

If one defines the integer random variable X as in Proposition 5.9 using the criterion that {Xi,... ,X^} 
contains 51,52 as in Proposition 5.10, it is easy to show that E[A] < £ + 2. In particular, E[A] < 9 for £ < 7. 

With these results in hand we now give a Monte Carlo algorithm for determining the set of primes £ 
for which Gsii) does not contain SL 2 (£). Note that when Gsi^) contains SL 2 (£) we can determine Gsii) 
exactly by computing the intersection of K with the cyclotomic field Q(0), a computation that does not 
depend on E and takes negligible time for any fixed number field K. 

Algorithm 6 . Given an elliptic curve E-. = f{x) over K = Q[a]/(F(a)) with integral coefficients and 

bounds P > L > 5, attempt to determine the set of primes £ < L for which SL 2 (£) 2 Gsii) as follows: 

1. Initialize S ^ {i < L prime} and create a table T with boolean entries 7£_i^,T£_ 2 , 7£,3 set to 0 for each 
i € S, then set ^ I for £ < 7. 

2. Compute the norm A^; G Z of the discriminant of E and the discriminant dp G Tt oi the polynomial F. 

3. Repeat the following 27|"I + logg M] times, where M = < L prime}: 

a. Pick a random prime p G [P, 2P] that does not divide or dp and a random prime p of K lying 
above p and use Algorithm 4 to compute Frobenius triples 

:= (det 5 _E,i(Frobp), tr ^^^^(Frobp), dimi 5 E_^(Frobp)) 

for each prime £ G S'. 

b. For each prime £ G S, set Ti^i ^ 1 if r^^p matches the conjugacy class of some gi G GL 2 (£) satisfying (i) 
of Proposition 5.8 (for £ > 7) or Proposition 5.10 (for £ < 7); if 7 £, 2 , Fk.s = 1, remove £ from S. 

4. Output the set S and terminate. 

Remark 5.11. As written this is not (strictly speaking) a Monte Carlo algorithm, since it uses Algorithm 4, 
which is a Las Vegas algorithm (meaning that is running time is potentially unbounded, even though its 
expected running is bounded by Proposition 5.2). This distinction has no practical relevance, but for the 
sake of staying consistent with our terminology, let us assume that Algorithm 6 automatically terminates 
Algorithm 4 if its actual running time exceeds its expected running time by an unreasonable factor, and 
terminates with failure in this case. Doing so decreases the probability of success only negligibly and we can 
easily keep it above 2/3. 
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Theorem 5.12. Assume the GRH and let K = Q[a]/(i^(a)) he a fixed number field. There is a Monte 
Carlo algorithm with one-sided error that, given a non-CM elliptic curve E/K in integral form = f{x) 
with f £ Z[a][a;], determines the set Se of primes I for which Ge{(.) does not contain SL 2 (£) with probability 
greater than 2/3. The running time of the algorithm is bounded by 

(log||/ll)'+°«, 

and the set S it outputs always contains Se- 

Proof. We use Algorithm 6 with the modification indicated in Remark 5.11. Under the GRH we may take 
L = (log by Proposition 4.3, and we may choose P so that logP = O(logU). It is clear from 

Propositions 5.8 and 5.10 that the set S output by Algorithm 6 always contains Se- Each call to Algorithm 4 
in step 3a then takes 0((log time, and these calls dominate the total running time. After 27 

iterations in step 3, for each prime i < L not in 5’^, the probability that i remains in S is less than 1/3 (this 
follows from Proposition 5.9 and the remark following Proposition 5.10, since we always have E[A'] < 9). 
After all 27 [1 + log 3 M] iterations, this probability is less than 1/(3M), and a union bound shows that the 
probability that any prime (. < L not in Se (of which there at most M) remains in S is less than 1/3. □ 

Remark 5.13. To amplify the success probability of Algorithm 6 we run it repeatedly and take the inter¬ 
section of all the sets S output by the algorithm as our final result. 

We now give a Monte Carlo algorithm to compute Ge{£) up to local conjugacy for a given set of primes i. 
Rather than attempting to compute the full signature s of each Ge{(.), we rely on the fact that s can 
be compactly represented by a subset s containing at most 11 triples, as explained in §3.6. Since we are 
sampling elements of s randomly, we have no way of knowing a priori whether a given triple necessarily 
belongs to s. Instead, we dynamically construct an approximation to s that we update whenever we find a 
triple that does belong to the minimal signature compatible with our current approximation; for example, 
whenever we find a triple whose projective order exceeds m(s) = max{|7r(g)| : g £ GE^i)} or does not 
divide A(s) = lcm{|7r(5)| : g £ G£;(£)}. When doing so we simultaneously remove any triples that are no 
longer necessary. Depending on the order in which we find elements, it may happen that the cardinality of 
our approximation to s temporarily exceeds 11, but its cardinality is always bounded by 0{log£) and will 
eventually be no greater than 11. 

Algorithm 7. Given an elliptic curve E: y^ = f(x) over K = Q[a]/(F(a)) with integral coefficients, a 
bound P, and a nonempty set S of primes less than P, attempt to compute Ge{£) up to local conjugacy for 
each prime £ £ S' as follows: 

1. Initialize variables ^ {}, = 0, ^ 0 for each £ £ S. 

2. Gompute the norm A^; £ Z of the discriminant of E and the discriminant dif £ Z of the polynomial F. 

3. Repeat the following 9max(S)|’l -I- log#S] times: 

a. Pick a random prime p £ [P, 2P] that does not divide Ae ov dE, b. random prime p of A above p, and 
compute the matrix Ap as in Theorem 5.5. 

b. For each prime £ £ S dividing (tr Ap)^ — 4A(p), determine whether the order of Ap mod £ is divisible 
by £ and if so, add the triple (1,2,1) to se. 

4. Repeat the following 9|’60-|-2|’1-|- loglog(l -|- max(S))] [1 -|- log#S] times: 

a. Pick a random prime p £ [P, 2P] not in S, a random prime p of A above p, and compute the integer 
matrix Ap as in Theorem 5.5. 

b. For each prime i G S: 

i. Compute A = Ap mod £ £ GL 2 (£), set A ^ A^, update se to reflect the triple (det A, tr A, dimi A). 

ii. Increment ci, and if tr A = 0 then increment ze. 

iii. Set A g- and update se to reflect the triple (det A,tr A,dimi A). 

5. If the cardinality of any of the sets se exceeds 11, return to step 3. 

6. For each prime i G S, use Algorithm 3 to construct generators for a subgroup Ge of GL 2 (£) for which 
s := sig(G£) satisfies s = se and \z{Ge) — zelce\ <1/8 (if this fails for any reason, return to step 2). 

7. Output the groups Ge (specified by generators) and terminate. 
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Remark 5.14. The constants in steps 3 and 4 are larger than necessary, and for practical implementation 
we note that steps 3 and 4 can be combined; we have written the algorithm this way in order to simplify 
the complexity analysis below. We also assume that Algorithm 7 is modified as in Remark 5.11 to terminate 
the Las Vegas algorithm used to compute Ap if its running time exceeds its expected running time by an 
unreasonable factor; this ensures that the running time of Algorithm 7 is bounded. 

Theorem 5.15. Assume the GRH. Let K = Q[a]/(A(a)) be a fixed number field, let EjK be an elliptic 
curve in integral form = f{x) with f G Z[a][x], let S be a set of primes £ < L that contains Se, with 
L = (log as in Proposition f.S, and let P = (log be as in Corollary f.l. Given inputs 

E, P, and S, Algorithm 7 correctly determines Ge(£) up to local conjugacy for all £ G Se with probability 
greater than 2/3, and its running time is bounded by 

(log||/ll)'+°('). 

Proof. As argued in the proof of Theorem 5.7, we have logV^; = 0(log||/||), and this implies logP = 
0(log log ll/ll). It follows from Theorem 5.5 that the time to compute Ap for any prime p with N{p) G 
[P,2P] is bounded by (log ||/||)°^^^. The number of primes dividing (tr Ap)^ — 47V(p) is bounded by logP = 
0(log log ll/ll), and it follows that the total time for step 3 is bounded by 0((log 11/11)^“''°^^^), and this also 
applies to step 4. The cost of updating is negligible because the cardinality of is bounded by a constant 
factor of log ^ < logP = (log log ||/||), and computing A^ can be accomplished in time 0(M(log^) log^), which 
is also polynomial in log log |1/||. The time for the check in step 5 is quasi-linear in ffS = 0((log 11/11)^“'’°^^^), 
the time for step 6 is bounded by 0(#S'(logP)^+°^^^) = 0((log ||/||)^''‘°^^^), by Proposition 3.22, and this 
also bounds the time for step 7. This addresses the bound on the running time of Algorithm 7, it remains 
only to show that its output is correct with probability greater than 2/3. 

Let £ G S' be a prime greater than 5 for which Ge{£) has order divisible by £. The proportion of elements 
of Ge{£) of order divisible by £ is at least l/£, since Ge{£) does not contain SL 2 (^) and must therefore either 
lie in a Borel group or be an exceptional group whose image in PGL 2 (^) has order divisible by £ = 3, 5 (the 
claim holds in either case). After 3maxS iterations of step 3 the probability that (1, 2,1) ^ Sf, is less than 
1/10, and after OmaxSI"! + log#S] iterations the probability that (1,2,1) ^ st for any £ G S for which 
Ge{£) has order divisible by £ is less than 1/10. 

The fact that step 4.b.iii is executed at least 18 [1 + log #5] times ensures that the probability that for 
some £ G S the set Sf does not contain the triple of a generator for the scalar subgroup of Ge{£) is very 
small, say less than 1/1000. The same comment applies to the probability that se does not contain a triple 
whose determinant generates det(G_E(£)) for some £ G S. 

For each £ G S, after 3 • 60 • [1 + log #5”] iterations of step 4 the probability that we have not encountered 
representative A in step 4.b.i for the projective image of every element of Ge{£) in the case that G(£) is an 
exceptional subgroup is less than 1/10, and after the completion of step 4 the probability that this is true 
for any £ G S' is less than 1/10. Similarly, for each £ G S, after Gfl + loglog(l +max(S))] iterations of step 4 
the probability that we have not encountered an A in step 4.b.i that has maximal projective order in the 
image of Ge{£) under the £-power map is less than 1/10, and after the completion of step 4 the probability 
that this is true for any £ G S is less than 1/10. 

Additionally, after the completion of step 4 the probability that for some £ G S for which Ge{£) has 
dihedral projective image the set se does not contain the signature of some h G Ge{£) whose projective image 
is not contained in the subgroup generated by some g G Ge{£) oi maximal projective order whose signature 
lies in se is negligible, say less than 1/1000. Finally, we note that the probability that \z{Ge{£)) —ze/ce\ > 1/8 
for any £ G S after the completion of step 3 is also negligible, say less than 1/1000. 

Taking a union bound, it follows that the probability that at the end of step 3 any of the sets se does 
not satisfy all the criteria listed in §3.6 for a suitable representative subset of s = sig(G£;(£)) is less than 
0.304 < 1/3, and this also bounds the probability that any se has cardinality greater than 11. Thus we 
expect to return to step 4 in step 5 just 0(1) times, and when we reach step 6 we will compute subgroups 
Ge that are locally conjugate to Ge{£) for all £ G S' with probability greater than 2/3. □ 

Unlike the Las Vegas algorithm given in §5.3, our Monte Carlo algorithm explicitly relies on the use of 
a compact representation se of the signature of G_e(£) that contains only a bounded number of triples (at 
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most 11, as noted in §3.6), and on the fact that we can compute Ap in subexponential time; both are crucial 
to obtaining a quasi-linear running time. 

5.5. Distinguishing locally conjugate subgroups. As written, our algorithms cannot distinguish non¬ 
conjugate subgroups G and G' of GL 2 (£) that are locally conjugate. However, as noted in Remark 3.7, up 
to conjugacy the only case in which this can occur is when G and G' are subgroups of the form G = {H, t) 
and G' = where t = (o i) H and H' are subgroups of the split Cartan group Cs{() that are 

conjugate via s = (5 J) (so 77' is with the diagonal entries swapped). As proved in Theorem 3.32, if 
G = Ge{£) for some elliptic curve EjK, then G' = Ge'{() for an elliptic curve E'/K isogenous to E that 
we can obtain by following a uniquely determined path of 7-isogenies with E and E' as endpoints. In most 
cases the curves E and E' are distinguished by the degrees of the minimal extensions of K over which they 
acquire a rational point of order In terms of the groups G := Ge{G) and G' := Ge'{G), these are precisely 
the indices c?i(G) and c?i(G') of the largest subgroups of G and G' that stabilize a nonzero vector; these 
indices necessarily divide (■ — 1, and in most cases they are distinct. In this section we give a Monte Carlo 
algorithm to compute c?i(G) that runs in quasi-cubic time, using the fact that E admits a unique rational 
isogeny of degree 

Remark 5.16. Even when di{G) = c?i(G'), after twisting E and E' appropriately (as described in §5.6), 
we may obtain a pair of elliptic curves E and E' for which G := G^(7) and G' := Gj^,{(.) are again 
locally conjugate, but with di{G) ^ di{G'). We are then able to distinguish G and G' by computing 
di(G) and di{G'). This technique allowed us to distinguish every pair of locally conjugate groups that we 
encountered in our computations (see §6), but we note that there are subgroups G and G' of GL2(7) to 
which it cannot be applied (the smallest example with surjective determinants occurs when I = 29). 

We begin with a general result that was mentioned in the introduction. Recall that for each elliptic curve 
E: y'^ = + Ax + B and integer m there is a square-free polynomial fE,m{x) with coefficients in Z[A,B] 

whose roots are the ^-coordinates x{P) of the nonzero points P € E[m\, called the m-division polynomial 
of E. For even integers m the factor x^ + Ax -I- 77 is typically removed from fE,m{x), in which case its roots 
are the x-coordinates of the points P G E[m\ — 77[2]. More generally, one can remove the factor fE,m'{x) 
for each maximal proper divisor m! of m. We refer to the resulting polynomial gE,m{x) as the primitive 
m-division polynomial of E, which we note has the same splitting field as fE,m,{x)\ the roots of gE,m{x) 
are the x-coordinates of the points in E[m] of order m. The polynomials fE,m and gE,m can be efficiently 
computed using well-known recursive formulas [48] . 

Lemma 5.17. Let E he an elliptic curve over a number field K, let m > 2 be an integer, and let L be 
the splitting field of the m-division polynomial fE,m{x) over K. If GE{in) contains —1 then K{E[m\) is a 
quadratic extension of L, and otherwise K(E[m\) = L. 

Proof. We first note that pE,m induces an isomorphism Gal{K{E[m])/K) G£;(m) by restricting each 

(T G Gal{K/K) to K{E[m]) C K. Let {P,Q} be a basis for E[m] as a Z/mZ-module and consider the 
subgroup 77 C GE{m) corresponding to the inclusion of Galois groups 

Gal(A"(7;[m])/L) C Gal(7s:(£;[m])/7s:). 

For each cr £ 77 we have cr(P) G E[m] and x{a{P)) = x(P), and similarly for Q and P -\- Q. This implies 
cr(P) = ±P, <7{Q) = ±Q, and cr(P) -I- (y{Q) = cr(P -|- Q) = ±(P -|- Q), and therefore PE,m{<x) = ±1; so 
77 C {±1}. If —1 G GEijn) then 77 = {±1}, since p)j\„(—1) fixes P, and otherwise 77 is trivial. □ 

Gorollary 5.18. Let E be an elliptic curve over a number field K, let m > 2 be an integer, let gE,m{x) be 
the primitive m-division polynomial of E, and let d be the minimal degree of a factor of gE,m{x) in 77[x]. If 
GE{m) contains —1 then di(G£;(m)) = 2d. 

Proof. We assume E-. y^ = x^ -G Ax -|- P is in short Weierstrass form. Let P G E[m] be a point of order m 
whose x-coordinate x(P) is a root of a minimal degree factor of gE,m{x). Then [77(x(P)) : K] = d, and 
[A"(P) :77(x(P))] < 2 since y{P)^ G K{x{P)). If —I G GE(m) then [K{P):K{x{P))] = 2, since cfp'e],^ 
K{x{P)) but acts non-trivially on K{P) (indeed, a{y{P)) = y{—P) = —y{P) y{P) for m > 2). □ 

Example 5.19. The converse of Gorollary 5.18 is false; the curve 14a3 gives a counterexample with to = 3. 
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Locally conjugate subgroups of GL 2 {i) necessarily have the same scalar subgroups, so having determined 
GE{t} up to local conjugacy, we know whether or not it contains —1. As noted above, we are specifically 
interested in the case where Ge{() is a Borel subgroup (so E admits a rational isogeny of degree €}. 

In what follows, the degree of a point P G E[m] is the degree of the extension K{P)/K obtained by 
adjoining the coordinates of P to Lf; equivalently, it is the degree of the minimal extension LjK for which 
P € E[m]{L). In terms of GE{rn) C Aut(P[m]), the degree of P is the index of its stabilizer in GE{rn). The 
quantity di(G'E(m)) is simply the minimal degree of a point of order m. 

Lemma 5.20. Let E be an elliptic curve over a number field K that admits a unique rational isogeny ip of 
prime degree i. The points in E[P\ of degree di{GE{(-)) all lie in the kernel of p. 

Proof. We may assume that Ge{£) lies in the Borel group B{i) and contains (q }); it cannot lie in the 
split Cartan Cs(£) because E admits only one rational isogeny of degree £ (up to composition with an 
isomorphism). The kernel of p consists of the points P G E[P\ whose stabilizer in Ge{£) contains (J ( )• The 
orbit of any P G ker(/3 under the action of Ge{£) has cardinality at most ^ — 1, since 'keip is Galois-stable 
and contains only £ — 1 nonzero points; the stabilizer of P therefore has index at most I — and it follows 
that di{G) < I' — I, since 'kerp contains points of order i. The stabilizer of any P G E[£\ of degree less than I 
must contain (JO, otherwise its index would be at least £, so every point of degree di{G) is in ker<^. □ 

For a rational isogeny p of prime degree t > 2, let hip G K[x\ denote the kernel polynomial whose roots 
are the distinct a:-coordinates x{P) of the points P G kerp C E\i]] it is a divisor of the ^-division polynomial 
fE,e{,x). The kernel polynomials h^ play a key role in Elkies’ improvement to School’s algorithm [26, 56]; 
the degree of hip{x) is just {£ — l)/2, compared to {£^ — l)/2 for fE,e{x). 

Corollary 5.21. Let E be an elliptic curve over a number field K that admits a unique rational isogeny 
p of prime degree I > 2, and let d be the minimal degree appearing of a factor of hip(x) in K[x\. Then 
di{GE{£)) G {di2d}, and if GE{i) contains —1 then di{GE{i)) = 2.d. 

Proof. The kernel of p has prime order £, hence it is generated by any nonzero P G ker p. By the previous 
lemma, these P all have degree di{GE{£))', let us pick one. The cyclic group (P) is invariant under the action 
of Gal{K{E[£])/K), so K{P)/K is a cyclic Galois extension, and it contains the splitting field of hp{x) over 
K, which must be equal to K{x{P)), an extension of degree d. Thus 

d^iGEii)) = [KiP):K] = [KiP):KixiP))] • [if(x(P)) :iF] 

is either d or 2d, depending on whether y{P) lies in K{x{P)), or a quadratic extension of K{x{P)). If Ge{£) 
contains —1 then the latter must hold, by Corollary 5.18. □ 

The kernel polynomial hy,{x) can be computed via Elkies’ algorithm (see [29, Alg. 27]), which uses the 
classical modular polynomial $£ G Z[A,F] that is a canonical model for the modular curve Xq{£). Under 
the GRH the polynomial can be computed in £'^+°G) expected time [12]. By Proposition 4.3, for 

elliptic curves E without complex multiplication, we may assume that £ is bounded by (log 11/11)^''’°^^^ where 

= fix') is an integral equation for E/K. This yields a reasonably efficient algorithm to compute h,p{x), 
but factoring hip{x) in K[x\ may be much more time-consuming; the complexity bounds in [40] for factoring 
polynomial in O/c]*] give a running time of (log H/]])^^’'’”*'^^. 

We can do much better than this by instead working modulo random primes p of K. As noted in the 
proof of Corollary 5.21, the Galois group Gal(P/Ar) of the splitting field L of hip{x) over K is cyclic, and 
this implies that we can compute the degree L/K by computing hp{x) modulo several random primes p and 
factoring the result over Fp := Ok/P (and we can restrict to degree-1 primes p); taking the least common 
multiple of the degrees of the factors will yield the degree of LjK with high probability (by the Chebotarev 
density theorem). Under the GRH it suffices to use p with logA^(p) on the order of log ]]/]] ^■'■°^^^; with 
probability greater than 1/2 just two primes p are already enough to determine [L\K\. 

The algorithm in [67] gives an efficient method to directly compute instantiated modular polynomials 
^i{j{E),Y) modulo p, as well as instantiated derivatives of $f(A, F) that are required by Elkies’ algorithm, 
allowing us to perform all our computations in finite fields Fp. The expected time to compute the reduction 
of hip in Fp[a;] is then bounded by (log ||/||)^'''°^^\ which also bounds the expected time to factor it in Fp[a;] 
using standard probabilistic algorithms (see [32, Thm. 14.14]). 
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Having computed d = [L : K], it remains only to determine whether di(G£;(£)) is equal to d or 2d. 
If —1 G Ge{(-) then Corollary 5.21 immediately implies the latter, and otherwise it suffices to determine 
whether the algebraic integer /(a) is a square in Ol^ where a is a root of the monic polynomial h^{x)] this 
computation can be efficiently accomplished via Hensel lifting and is dominated by the time to compute h^{x). 
The following proposition summarizes our discussion. 

Proposition 5.22. Let E: = f{x) be a non-CM elliptic curve over a number field, and suppose that E 

admits a unique rational isogeny of degree i. Under the GRH there is a Monte Carlo algorithm to compute 
di(G_E(£)) whose running time is bounded by (log . 

Remark 5.23. We can easily determine ahead of time whether or not computing di{GE{C)) will distinguish 
two locally conjugate possibilities G and G' for Ge{(.). As noted above, we may assume that G and G' he 
in the Borel group B[£) and are thus upper triangular, in which case di{G) can be computed as the least 
common multiple of the orders in Z(£)^ of the upper left entries of a set of generators for G, which takes 
just (log£)^+°^^^ time (and similarly for G'). 

5.6. Quadratic t-wists. Recall that if EjK is an elliptic curve and A is a quadratic extension of K, an 
elliptic curve E' /K whose base change to F is isomorphic to that of if is a quadratic twist of E. Up to K- 
isomorphism, for each quadratic extension F/K there is a unique elliptic curve E^ that is not A"-isomorphic 
to E. Concretely, if E is defined by the equation = f{x) and F = K{\fd), then = f{x) is an equation 
for E^\ we assume throughout this section that E and E^ are defined by equations of this form. 

We wish to consider the relationship between the Galois images Ge (£) and G^f (£). For i = 2 we always 
have Ge{£) = Gef{£), since E[2] = E^[2], so we assume £> 2. Most of our results in fact apply to any 
integer m > 2, so we will work in this generality. The m-torsion points of E and E^ differ only in their 
y-coordinates, thus the splitting fields of the m-division polynomials fE.mix) and fE’^.mi^) are identical; let 
L denote this field. It follows from Lemma 5.17 that either the m-torsion fields K{E[m]) and K{E^[m\) are 
both quadratic extensions of L (the generic case), one is equal to L and the other is a quadratic extension, 
or both are equal to L. Which case occurs depends on whether both, one, or neither of the groups GE{m) 
and GErijn) contain —1. 

Lemma 5.24. Let E be an elliptic curve over a number field K, let F be a quadratic extension of K, let 
m > 2 be an integer, and let L be the splitting field of the m-division polynomial of E. Then —1 ^ GEr{rn) 
if and only if K{E[m\) is the compositum of F and L. 

Proof. Let F = K{\fd), E: y'^ = f{x), and E^: dy'^ = f{x), and let ip: (xo,yo) (xo,yo/Vd) be the 
isomorphism between the base changes of E and E^ to F. We first suppose that K{E[m]) is the compositum 
of F and L and show that —1 ^ GEr{m). It F C L then K(E[m]) = L and the base changes of E and E^ 
to L are isomorphic, hence K{E^[m]) = L and GEr{m) does not contain —1, by Lemma 5.17. It F L, 
then K{E[m]) = L{\/d) and K{E^ [m]) C L{y/d), and we claim that in fact K{E^[m]) = L. Let a be the 
non-trivial element of Gal{L{'/d)/L), corresponding to —1 € GEirn). Then a{\fd) = —'/d and cr(yo) = —yo 
for any nonzero P = {xo,yo) G E[m\, it follows that cr fixes <p{P), thus K[E^[m]) = L and —1 ^ GEpim). 

We now suppose that K{E[m]) is not the compositum of F and L and show that —1 G GEp{m). It F C L 
then K{E\m\) is a quadratic extension of L and the base changes of E and E^ to L are isomorphic; we 
cannot have K{E^\m]) = L, since this would imply K{E[m]) = L. It F % L then F % K{E[m]) and we 
cannot have K{E^[m]) = L, since this would imply '/d and therefore F is contained in K{E[m]). Thus in 
either case K{E^[m]) ^ L, and this implies —1 G GEF{m), by Lemma 5.17. □ 

Corollary 5.25. Let E be an elliptic curve over a number field K, let F be a quadratic extension of 
K, let m > 2 be an integer, let L be the splitting field of the m-division polynomial of E, and let G := 
(GE(m),-l). 

(a) //—1 G GE{rn) then GEpijn) is conjugate in GL 2 (m) to either G or an index 2 subgroup of G that 
does not contain —1; the latter occurs precisely when F is a subfield of K{E[m\) not contained in L. 

(b) If —1 ^ GE{rn) then GEpijn) is conjugate in GL 2 (m) to either G or an index 2 subgroup of G that 
does not contain —I; the latter occurs precisely when F is a subfield of L. 

Proof. Let F, E, E^, and p be as in the previous lemma, and let us fix bases for E\m\ and E^[m] as 
Z/mZ-modules that are compatible with p after base change. As an element of GL 2 (m), the action of any 
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a G Gal{K/K) on E[i] and E^[i] with respect to our chosen bases can differ only up to sign, thus we may 
assume GE{rn)/{GE{rn) fl {± 1 }) = G e’’ {m)/{G ep {rn) fl {± 1 })- 

We first consider (a), with —1 G GEim). In this case K{E\m\) is a quadratic extension of L, by 
Lemma 5.17. If K{E[m]) is not the compositum of E and L, then GEpim) contains —1 and K{E^[m]) 
is also a quadratic extension of L (by the previous lemma), and therefore contains —1; we thus have G£:F(m) 
conjugate to GE{m) = G, and either F does not lie in K{E[m]) or it is contained in L. If K{E[m]) is 
the compositum of F and L, then K{E[m\) = L{'/d) and the previous lemma implies that —1 ^ GEp(jn) 
and therefore K{E^[m]) = L. The actions of Gal{L{Vd)/K{\/dj) on E[m] and Gal{L/K) on E^[m] with 
respect to our chosen bases commute with the isomorphism ip, and it follows that Gep {m) is conjugate to 
the index 2 subgroup of GE{m) = G corresponding to Gal{L{'/d)/K{'/d)) = Gal{K{E[m])/F), which does 
not contain —1, and this occurs only when T’ is a subfield of K{E[m]) not contained in L. 

We now consider (b), with — 1 ^ GE{m). in which case K{E\m] = L is a subfield of K{E^[m])^ by 
Lemma 5.17. li F % L then K{E\m]) is not the compositum of F and L and —1 G GEp{rn), by the previous 
lemma; by the same argument used above, this implies that GE{m) is conjugate to an index 2 subgroup 
of GEpim), and we must have GEpim) conjugate to G. If C L then K{E[m]) = L and —1 ^ GE{m), 
and since K{E[m]) is the compositum of F and L, we also have —1 ^ GEp{m), by the previous lemma. So 
GEp{in) = G£;(m) is an index 2 subgroup of G not containing —1, and this occurs only when F Q L. □ 

In case (b) of Corollary 5.25, when is a subfield of L the Gtorsion fields of E and its twist E^ coincide, 
but E[m] and E^[m] are typically not isomorphic as Galois modules, and G£;(m) and GEpim) need not be 
conjugate (or even locally conjugate) in GL 2 (m), as shown by the following example. 

Example 5.26. Let E/Q be the elliptic curve + y = — lOx — 20 with Cremona label llal, which 

we may also write as y^ = x^ — 13392a: — 1080432. Its quadratic twist by F = Q(-\/5) has Cremona label 
275b2. The torsion field Q(F[5]) can be written as Q[a]/(a"‘ — — a + 1) and is equal to the splitting 

field L of the 5-division polynomial of E. The field Q(F[5]) contains F, so Q(F^[5]) = Q(F[5]), and Ge^^) 
and Gep{£) are both index 2 subgroups of G = (G_e(£),— 1), but they are not conjugate. Indeed, one finds 
that GE{i) — (( 02 )) ^ep W — (( 04 )) non-conjugate cyclic groups of order 4. If we instead twist E 
by a quadratic field E' not contained in L, say E' = Q(\/—3), we obtain the elliptic curve with Cremona 
label 99d2 and find that G^f' (£) is conjugate to both (± (J 2 )) and (± (g 4 )). 

In the previous example we obtained three non-conjugate subgroups of GL 2 ( 5 ) as images of Galois repre¬ 
sentations arising in a family of quadratic twists of single elliptic curve E. The following lemma shows that 
for m = £ prime, up to conjugacy, three is maximal and can occur only when Ge{G) lies in a Borel group. 

Lemma 5.27. Let E he an elliptic curve over a number field K, let i be a prime, and let n be the number 
of non-conjugate subgroups of GLi 2 {£) that arise as Gep{£) for some guadratic twist E^ of E. Then n < 3; 
the case n = 3 can occur only when Ge(£) lies in a Borel group, and the case n = 2 can occur only when 
Ge{£) lies in either a Borel group or the normalizer of a Cartan group. 

Proof. For £ = 2 we always have n = I, so we assume that £ is odd and put G := (G_e(£),— I). It follows 
from Corollary 5.25 that n is at most one more than the number of index 2 subgroups of G that do not 
contain —1. Thus if G£;(£) = G contains —I and has no index 2 subgroups that do not contain —I, then 
n = I; this applies whenever G_e(£) contains SL 2 (£) or has projective image isomorphic to A 4 , S 4 , or A 5 (by 
Lemma 3.21). By Proposition 3.1, we may now assume that G_e(£) (and therefore G) is contained in either 
a Borel group or the normalizer of Cartan group (possibly both). 

Let us first suppose that the image of G in PGL 2 (£) is dihedral; then G is a subgroup of the normalizer 
G+ of a Cartan group G. If G 2 is an index 2 subgroup of G that does not contain —1, then G 2 also has 
dihedral image in PGL 2 (£). If we put H := G fl G and H 2 := G 2 H G and apply Lemma 3.13, we must be in 
case (2a) of the lemma, since El 2 does not contain — 1 , and ££2 is an index 2 subgroup of H that is normal 
in G’*'. It follows from Corollaries 3.17 and 3.18 that £72 determines G 2 , and H has at most one index 2 
subgroup that does not contain —1 and is normal in G+, so there is at most one possible G 2 ; thus n <2. 

If G lies in a non-split Cartan group Gns then it has at most one index 2 subgroup, since G„s is cyclic, 
and we again have n <2. Otherwise G lies in a Borel group B, which we now assume. The group G and its 
index 2 subgroups are uniquely determined by their intersections with the split Cartan group Gg contained 
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in B] these are abelian groups, each of which can be written as a product of at most two cyclic groups. 
It follows that G n Cs has at most three subgroups of index 2. If it has three, then at least one of them 
must contain —1, since if Hi and H 2 are distinct index 2 subgroups of G fl Cg that do not contain —1 then 
{Hi n iJ 2 , —1) is an index 2 subgroup that contains —1. Thus G has at most two index 2 subgroups that do 
not contain —1, and we therefore have n < 3. □ 

Remark 5.28. Lemma 5.27 does not apply to composite integers m. Indeed, for m = 8 there may be 
as many as 20 non-conjugate G^pim) that arise as F ranges over quadratic extensions of K; see [52] for 
examples. 

For any subgroup G of GL 2 (^) we refer to (G, — 1) and its index 2 subgroups that do not contain —1 as 
twists of G (so G is always a twist of itself). If G = Ge{() for some elliptic curve E/K then the twists 
of G are precisely the subgroups that arise as Gep{(-) for some quadratic twist (up to conjugacy in 
GL 2 (.^)). Quadratic twists that realize every possibility for Gep{() can be efficiently constructed using 
the results in this section. It suffices to determine the quadratic fields that lie in K{E\i]) (of which there 
are at most 3), and to determine which of these quadratic fields lies in the splitting field L of the ^-division 
polynomial of E. The discriminants of these quadratic fields must divide the discriminant of K{E[i\)^ whose 
prime divisors include only £ and the primes of bad reduction for E. Provided we can factor the discriminant 
of E, these fields can be determined by simply testing candidate fields F with suitable discriminants by 
computing G£;f(£); in practice this is much faster than attempting to explicitly compute the torsion field 
K{Ge{()) and the quadratic extensions F/K it contains. 

Remark 5.29. If G is locally conjugate to G', then each of its twists H is locally conjugate to a corresponding 
twist H' of G'. If G = Ge{£) for some elliptic curve E /then the twists of G and the twists of any locally 
conjugate G' all arise as images of Galois representations of elliptic curves defined over K. Thus the discovery 
of a subgroup G of GL 2 (£) that arises as G_e(£) may lead directly to as many as 5 other non-conjugate 
subgroups G' that arise as the image of Galois representations of curves that are twists of either E or the 
elliptic curve E' isogenous to E given by Theorem 3.32. 

Example 5.30. Consider the elliptic curve E/Q with Cremona label lla3, which has Ge{?>) = (( 0 2 ) ( 0 1 ))■ 
The group Ge{^) has three twists, including itself. The other two are (Ge( 5),—1) and its index two 
subgroup ((0 3 ) (0 1 ))j which can be obtained as Galois images by twisting E by Q(-\/^) and Q(-\/5), which 
yields curves with Cremona labels 99dl and 275bl, respectively. The group G£;(5) is locally conjugate to 
Ge' (^) = ((0 1 ) (0 1 )); where E' has Cremona label lla2. Twisting E' by Q(-\/^) and Q(-\/5) yields curves 
with Cremona labels 99d3 and 275b3, respectively, whose Galois images realize the corresponding twists of 
Ge'(£). The six subgroups of GL 2 ( 5 ) in this example are non-conjugate and listed in Table 3 under the 
labels 5b. 1.1, 5B. 1.2, 5B. 1.3, 5B. 1.4, 5B.4.1, and 5B.4.2 (the curves listed in Table 3 for these groups 
are not all the same as those in this example, some have smaller conductor). 

6. Computational Results 

We implemented the algorithms described in Section 5 using the C programming language (as noted 
earlier. Magma scripts implementing the algorithms in Section 3 are available at [68]). For the computation 
of Frobenius triples in Algorithm 4, at primes up to 2'^^ we relied on the small jac software library [63] based 
on the algorithms described in [35] , and for larger primes we used the implementation of the SEA algorithm 
described in [67]. For the computation of the matrices Ap described in §5.2 we used a modified version of 
the algorithm in [9] that was optimized for smaller primes, using techniques described in [64, §4] and [67]. 

As a key practical optimization, we precomputed tables of Frobenius triples for every elliptic curve E/Fp, 
for primes p < 2^®. This allows us to compute Frobenius triples for the reductions of an elliptic curve E 
over a number field K at degree-1 primes p oi K with N{p) < 2^® by simply doing a table lookup; this is 
particular useful when computing Galois images for large families of elliptic curves. While 2^® is typically 
much smaller than the (log bound given by the CRH-based Chebotarev bounds of Corollary 4.7, 

in the typical case where pE,e is surjective we can usually obtain an unconditional proof of this fact by 
computing Frobenius triples for just a handful of small primes of good reduction; typically just ten or twenty 
primes suffice. This optimization dramatically improves the practical efficiency of our algorithms because 
it allows us to very quickly determine a small set of primes S that we know contains the set of exceptional 
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primes Se (the primes i for which Ge{(-) does not contain SL 2 (^)); this is the main motivation for treating 
Algorithms 6 and 7 separately. 

We have applied our algorithms to several large databases of elliptic curves, including: 

• Cremona’s Elliptic Curve Data [19], which includes all elliptic curves over Q of conductor less than 
350,000 (about 2 million curves); 

• the Stein-Watkins Table of Elliptic Curves [61], which includes a large proportion of the elliptic 
curves over Q of conductor up to 10®, and of prime conductor up to 10^° (about 140 million curves); 

• the L-functions and Modular Forms Database (LMFDB) [44, 45], which includes Cremona’s tables 
as well as some 150,000 elliptic curves of small conductor over quadratic and cubic fields. 

We also analyzed more than 10® elliptic curves of bounded height over Q and ten quadratic fields (the five 
real and five imaginary quadratic fields of least absolute discriminant). In addition to these, we analyzed 
elliptic curves in families parameterized by various modular curves, including: 

• the modular curves Xh of genus 0 described in [74]; 

• the modular curve Ars4(7) of genus 0 over Q{y/—7), using the model in [36]; 

• the modular curve Ar+(11) of genus 2, using the model in [2]; 

• the modular curve Ar+^(11) of genus 1, using the model in [16]; 

• the (isomorphic) modular curves ^+(13) and X+,(13) of genus 3, using the models given in [4]; 

• the modular curves Xo{£) for primes ll<^<61of genus up to 5, using the models provided by the 

Magma [11] function SmallModularCurve, as well as quadratic points on these curves found in [13]. 

We restricted our attention to elliptic curves without complex multiplication and used our Monte Carlo 
algorithm to compute Ge{£) up to local conjugacy. In cases where we were not able to unconditionally 
prove Ge{£) = GL 2 (.^) we repeated the algorithm 200 times, thereby ensuring (under the GRH) that the 
probability of error is less than 3“®®®. 

Having computed Ge{£) up to local conjugacy, in each case with two non-conjugate groups G and G' locally 
conjugate to Ge{£) we computed di{GE{£)) via Proposition 5.22, and in cases with di{G) ^ di(G') used 
this information to determine Ge{£) up to conjugacy. We encountered only one case with di(G) = di{G'), 
arising for the groups labeled IIB. 10.4 and IIB. 10.5 in Table 3, but in this case G and G' have twists that 
are not locally conjugate, and by twisting E appropriately we were able to determine Ge{£) up to conjugacy, 
as described in §5.6. 

Remark 6.1. Thanks to recent work by Zywina [74], for the elliptic curves E/Q that we found to have 
exceptional Galois images Ge{£), we were able to independently verify our results using his explicit models 
of modular curves Xh/Q, of prime level that include every subgroup H of GL 2 (.^) that is known to arise for 
a non-CM elliptic curve over Q; in no instance did we find an error in our computations. 

6.1. Results over Q. In total we found 63 exceptional Galois images Ge{£) for non-GM elliptic curves 
E/Q. These are listed in Tables 3 and 4, along with an elliptic curve of minimal conductor that realizes 
Ge{£)- In collaboration with John Gremona, our results for elliptic curves of conductor up to 350,000 have 
now been incorporated into Gremona’s tables and the LMFDB. 

Remark 6.2. Although we analyzed a total of more than 10^® elliptic curves E/Q, every exceptional Ge{£) 
that we found already occurs for a curve in Cremona’s tables; indeed the largest conductor needed to obtain 
every exceptional Ge{£) that we found is 232, 544, which is the conductor of curve listed for the group labeled 
llNn. 

6.2. Results over quadratic fields for elliptic curves -with rational j-invariants. It follows from 
Conjecture 1.1 that the exceptional Galois images Ge{£) that do not contain SL 2 (£) that can arise when E 
is the base change of a non-CM elliptic curve over Q to a quadratic field are, up to conjugation in GL 2 (^), 
the 63 exceptional Ge{£) that arise over Q and their subgroups of index 2. Using Algorithm 2, we can easily 
enumerate these groups, and we find that up to conjugacy in GL 2 (^), there are are 68 groups Ge{£) that 
arise for base changes from Q to a quadratic field but not over Q. 

An elliptic curve E over a quadratic field K whose j-invariant lies in Q is either the base change of an 
elliptic curve over Q, or a twist of such a curve. As we are only concerned with elliptic curves without 
complex multiplication, we can assume j{E) {0,1728} and only need to consider quadratic twists. It 
follows from Corollary 5.25 that the groups Ge{£) that can arise when E is an elliptic curve over a quadratic 
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field with j{E) € Q are the groups G that arise for base changes from Q and their twists, as defined in §5.6: 
these are the groups (G, —1) and its index 2 subgroups that do not contain —1. A computation shows that, 
up to conjugation in GL 2 (£) and assuming Conjecture 1.1, there are 23 such twists that do not arise for the 
base change of an elliptic curve over Q, We thus obtain the following result. 

Theorem 6.3. Assume Conjecture 1.1. Up to conjugation in GL 2 (.^) there are 160 Galois images Ge{£) 
that do not contain SL 2 (.^) and arise for non-CM elliptic curves E over quadratic fields with j{E) G Q and 
primes 1; these are listed in Tables 3-8. Of these, 63 arise over Q, 68 arise for base changes of elliptic curves 
over Q but not over Q, and 29 arise only for elliptic curves that are not base changes from Q. 

Of the 68 exceptional groups that arise for base changes Ek of elliptic curves i?/Q to quadratic fields 
K (but not over Q), 23 have surjective determinant map (these are listed in Table 5) and 45 do not (these 
are listed in Table 6). Along with each group we list an elliptic curve A/Q and the discriminant H of a 
quadratic held K for which Gek{^) is conjugate to the group listed. In each case AT is a subheld of Q(A[£]); 
taking D = to be the discriminant of the quadratic subheld of the cyclotomic held Q(C£)) yields the 

subgroup of Ge{E) with square determinants, while any other quadratic subheld K of Q(£'[.^]) yields a group 
whose determinant map is surjective. 

The 29 elliptic curves listed in Tables 7 and 8 are quadratic twists E^ of base changes of elliptic curves 
A/Q to quadratic helds K by quadratic subextensions E/K of K{Ek[^\)/K that were computed using the 
methods described in §5.6. 

6.3. Results over quadratic and cubic fields. As noted above, the LMFDB includes tables of elliptic 
curves of small conductor over various quadratic and cubic helds, including the hve real and hve imaginary 
quadratic helds of least absolute discriminant, as well as the cubic held of discriminant —23. The enumeration 
of modular elliptic curves over the hve imaginary quadratic helds Q(\/^), Q(-v/^),Q(\/^), Q(\/^), and 
Q(\/—11) was originally addressed by Cremona in [20, 21] who constructed tables for elliptic curves of 
conductor norm up to 500; these results have recently extended to conductor norm 10,000 by Cremona and 
his student Warren Moore. The tabulation of elliptic curves over the real quadratic held Q(-\/5) described 
in [10] has been extended to conductor norm 5,000, and the LMFDB also contains data for elliptic curves 
over Q(-\/2) and Q(-\/3) to conductor norm 5,000, and over Q(-\/l3) and Q(-\/T7) to conductor norm 2,000 
and 1,000, respectively (as of this writing). In addition, elliptic curves over the cubic held Q[a]/(a^ — + 1) 

of discriminant —23 of conductor norm up to 10,000 are included in the LMFDB, based on the work in [24]. 

In total, we computed Ge{G) for 115,894 non-CM elliptic curves over these helds that are listed in the 
LMFDB, as well families of elliptic curves of bounded height, and curves parameterized by points of bounded 
height on the modular curves listed above. Tables 9-11 list the exceptional groups Ge{(-) that we found for 
non-CM elliptic curves over the ten quadratic helds noted above that are not already listed in Tables 3-8. 
It follows from [74] and the results of §5.6 that these groups cannot arise for non-CM elliptic curves over 
quadratic helds that have rational j-invariants (we do not require Conjecture 1.1 here because these groups 
all lie in the Borel group). 

Table 12 lists the exceptional groups Ge{,(.) that we found for non-CM elliptic curves over the cubic held 
of discriminant —23 that do not already appear in Tables 3-11. 

Remark 6.4. Unlike the results listed in Tables 3-8, which are complete under Conjecture 1.1, Tables 9-11 
are known to be incomplete. In particular, it follows from [43, Prop. 4.4.8.1] that there are inhnitely many 
elliptic curves over each of the ten quadratic helds that we consider with Gb)!!) conjugate to a subgroup of 
1134, but none are listed in our tables. 

Remark 6.5. The elliptic curves listed in Table 3 for the groups labeled 7Ns.2. 1 and 7Ns.3.1 both have 
j-invariant 2268945/128 and represent the unique Q-isomorphism class of elliptic curves A/Q that are 
exceptions to the local-global principle for isogenies [65]: each admits a rational 7-isogeny locally everywhere 
(modulo every prime of good reduction), but not globally (over Q). The elliptic curve listed in Table 5 for 
the group labeled 13A4.1 [2] is the base change of the elliptic curve over Q listed in Table 4 for the group 
labeled 1334 to Q(-\/l3); it represents one of hve Q-isomorphism classes of elliptic curves over Q(vT3) that 
are exceptions to the local-global principle for 13-isogenies [3, Cor. 1.9] (three have rational /-invariants and 
two do not). The elliptic curve listed in Table 5 for the group labeled 5Ns[2] is one of inhnitely many 
examples of elliptic curves over Q(-\/5) with distinct /-invariants that admit a 5-isogeny locally everywhere 
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but not globally, as proved in [3, Thm. 1.5], as is the curve listed in Table 9 for the group labeled 5Ns . 2.1 [2]. 
These curves all have Ge{5) conjugate to 5Ns[2] or 5Ns.2.1[2]; the former case may arise for the base 
change of an elliptic curve E/Q with G'£;(5) conjugate to 5Ns, while the latter case can only arise only for 
elliptic curves E/Q{y/5) with j{E) ^ Q. 


6.4. Group labels. In the tables that follow conjugacy classes of subgroups G of GL 2 (.^) are identified by 
labels of the form 

£S.a.b.c[d], 

where £ is a prime, S is one of G, B, Cs, Cn, Ns, Nn, A4, S4, A5, while a, b, c are (optional) nonnegative 
integers whose meaning depends on S, as described below, and d is the index of det(G) in Z(£)^; the suffix 
[d] is omitted when d = 1. Let r be the least positive integer that generates the index d subgroup of Z{£)^. 
G: G contains SL 2 (£); the label £G denotes GL 2 (-^) and £G[d] is used when d = [GL 2 (-^) : G] > 1. 

B: G is conjugate to a subgroup of B{£) that contains an element of order £, The label £'& denotes B{£) 
and £B[d] denotes £B fl £G[d]. The label £'&.a.b[d] denotes the subgroup generated by 


0 

1 /a 


0 

r/b 


where the integers a,b > 0 are both as small as possible. 

Cs: G is conjugate to a subgroup of Gs{£) (including subgroups of Z{£) C Gs{£)) The label .^Cs denotes 
Gs{£) and £Cs[d] denotes ^Cs fl £G[d]. The label £Cs.a.b[d] denotes the subgroup generated by 


0 

1 /a 


0 

r/b 


with a, 6 > 0 minimal. 

Cn: G is conjugate to a subgroup of Cns(£) that does not lie in Gs(£). For £ = 2 this is the index 2 
subgroup of GL2(2), which is denoted 2Cn. For £ > 2 the label ^Cn denotes G„s(£), and .fCn[d] 
denotes ^Cnn^G[d]. The labeh'Cn.a.6[d] denotes the subgroup generated by 

’ a eb^ 
b 

with the integers 6 > 0, a > 0 chosen to make (a, b) lexicographically minimal. 

Ns: G is conjugate to a subgroup of G+ {£) with dihedral projective image. The label £Ns denotes G/"(£), 
the label £Ns[(i] denotes £Ns fl £G[d], and £Ns.a.6[d] denotes the subgroup of Cf{£) generated by 


0 

1 /a 


0 

—r/b 


with a and b minimal, and £'Ns.a.b.c[d] denotes the subgroup generated by 

a0\/0 b\ f 0 c 
0 1/a) ’ V-1/6 o) ’ l^-r/c 0 

with a, 6, c > 0 minimal. 

Nn: G is conjugate to a subgroup of G/j,(£) with dihedral projective image and not conjugate to any 
subgroup of G+(£). The label £Nn denotes Gj/,(£) and £Nn[d] denotes £Nnn£G[d]. The label £Nn.a.6[d] 
denotes the subgroup generated by 

eb^ 


1 0 
0 -1 


with (a, b) lexicographically minimal, and £Nna.6.c[d] denotes the subgroup generated by 

eb'^ 


1 0 
0 -1 




where 6 = {y '^x ) is any generator for Gns{£) and c = lZ(£) : G fl Z{£)] as in Corollary 3.17. 
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A4: G has projective image isomorphic to A 4 and does not contain SL 2 (£). This requires d > 1. The label 
£kA.a[d] indicates [det(G) : det(Z'(G)] = a (which must be 1 or 3, the latter only when £=1 mod 3). 
Algorithm 1 can be used to obtain an explicit set of generators. 

S4: G has projective image isomorphic to S 4 and does not contain SL 2 (^). The label ^S4 indicates 
Z{G) = Z{£) and d = 1, while £S4[d] is used for d > 1 when [det(G) : det(Z(G))] = 2, and £S4.1[d] 
is used when [det(G) : det(Z(G))] = 1 (which implies d > 1). See Lemma 3.21 for a list of the cases 
that can occur. Algorithm 1 can be used to obtain an explicit set of generators. 

A5: G has projective image isomorphic to A 5 . This requires £ = ±1 mod 5 and d > 1. The label £A5.[d] 
indicates [det(G) : det(Z(G))] = 1 (the only possible case, by Lemma 3.21). Algorithm 1 can be 
used to obtain an explicit set of generators. 

A magma script that will compute the label of any subgroup of GL 2 (£) is available at [ 68 ] ; it also includes 
a procedure to construct a subgroup based on its label, with generators as above. 

6.5. Tables of exceptional Galois images. Each of the tables that follow lists the following data: 

• the first column lists the label of a group G C GL 2 (.^), as defined above, the second columns lists its 
index in GL 2 (£), and the third lists the generators for G as indicated by the label; 

• the column"—1” indicates whether the group G contains the scalar matrix —1 or not; 

• t is the number of twists the group has (as defined in §5.6), equivalently, the number of non-conjugate 
Ge'{£) that arise among the twists E' of E (defined over the same held K). 

• do is the index of the largest subgroup of G that hxes a linear subspace of Z(£)^; equivalently, the 
degree of the minimal extension over which E admits a rational Gisogeny. 

• di is the index of the largest subgroup of G that hxes a nonzero vector in Z(t')^; equivalently, the 
degree of the minimal extension over which E has a rational point of order £. 

• d is the order of G; equivalently, the degree of the minimal extension L/K for which E[£\ C E{L). 

• the curve column lists the Weierstrass coefficients [ 04 , 02 , 03 , 04 , 06 ] of an integral equation 

y'^ -I- aixy + 03 J/ = + a 2 X^ + a^x + 05 

that dehnes an elliptic curve E/K. When AT ^ Q, these may be polynomials in o S Ok with 
minimal polynomial /(o), in which case the curve is listed as [oi, 02 , 03 , 04 , a 6 ]/(/(a)). Curves are 
linked to their entry in the LMFDB, when available 

• for elliptic curves E over quadratic helds with j{E) G Q that are not base changes we list j{E). 

• N \B the absolute norm of the conductor of the elliptic curve E in factored form. 

• D is the discriminant of the number field K (not listed when K = Q). 

Pairs of locally conjugate groups are indicated by brackets on the left, and for each such pair the listed 
curves are related by a chain of Gisogenies, as in Theorem 3.32. Recall from Section 2 that we view elements 
of Aut(£'[.^]) as 2 X 2 matrices that act on column vectors on the left (this distinction is important because 
many of the groups are not conjugate to their transposes). 
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group 

index 

generators 

-1 

t 

do 

di 

d 

curve 

N 

2Cs 

6 



yes 

1 

1 

1 

1 

[1,1,1,-10,-10] 

3I51 

2B 

3 

ill) 


yes 

1 

1 

1 

2 

[1,0,1,4,-6] 

2^71 

2Cn 

2 

i\\) 


yes 

1 

3 

3 

3 

[0,-l,0,-2,l[ 

2272 

3CS.1.1 

24 

ill) 


no 

2 

1 

1 

2 

[1,0,1,4,-6] 

2^7^ 

3Cs 

12 

(2Q\ 

2) 

dll) 

yes 

2 

1 

2 

4 

[1,1,0, 220, 2192[ 

2I72 

3B.1.1 

8 

ill) 

dll) 

no 

3 

1 

1 

6 

[1,0,1,-1,0] 

2^7^ 

3B.1.2 

8 

ill) 

dll) 

no 

3 

1 

2 

6 

[1,0,1,-171,-874] 

2^7^ 

3Ns 

6 

(20\ 
1 0 2 J 

('0 2') (1 O'! 

^ yi 0 / ^ yo 2 J 

yes 

1 

2 

4 

8 

[1,1,1,3,-5] 

2^3^ 

3B 

4 

/2 0\ 
V 0 2 J 

('1 O') ('1 I'l 

^ yo 2 ) ^ yo 1 J 

yes 

3 

1 

2 

12 

[1,1,1,-3,1] 

2^5^ 

3Nn 

3 

(10) 
yo 2 ) 

(2 1) 

^ y 2 2 J 

yes 

1 

4 

8 

16 

[0,0,1,-7,12] 

5^7^ 

5CS.1.1 

120 

(10) 
\0 2 ) 


no 

3 

1 

1 

4 

[0,-1,1,-10,-20] 

lE 

5CS.1.3 

120 

(30) 
1 0 4 J 


no 

3 

1 

2 

4 

[0,1,1,-258,-2981] 

5^11^ 

5CS.4.1 

60 

(40) 
1 0 4 J 

(1 0) 

^yo 2 ) 

yes 

3 

1 

2 

8 

[0,0,1,-93,625] 

3^11^ 

5NS.2.1 

30 

1^2 0\ 
V 0 3 

(0 1) 

^y3 0 ) 

yes 

1 

2 

8 

16 

[0,0,1,-2850,-58179] 

3^5^31^ 

5Cs 

30 

('2 0') 

dll) 

yes 

1 

1 

4 

16 

[0,1,0,-4319,-100435] 

2®71^ 

5B. 1.1 

24 

ill) 

dll) 

no 

3 

1 

1 

20 

[0,-1,1,0,0] 

lE 

5B.1.2 

24 

ill) 

dll) 

no 

3 

1 

4 

20 

[0,-1,1,-7820,-263580] 

lE 

5B.1.4 

24 

('40') 
1 0 3 J 

dll) 

no 

3 

1 

2 

20 

[1,0,1,-76,298] 

2^5^ 

5B. 1.3 

24 

ill) 

dll) 

no 

3 

1 

4 

20 

[1,0,1,-1,-2] 

2^52 

5Ns 

15 

ill) 

('2 O') (1 0) 
5l03/’V02/ 

yes 

1 

2 

8 

32 

[0,0,0,-56,4848] 

2^19^ 

5B.4.1 

12 

('40') 
V 0 4 J 

(10) (11) 

^ yo 2 ) ^ yo 1 J 

yes 

3 

1 

2 

40 

[0,0,1,-3,-5] 

3^11^ 

. 5B.4.2 

12 

(40) 
1 0 4 J 

('2 O') (11) 

^ yo 1 ) ^ yo 1 ) 

yes 

3 

1 

4 

40 

[0,0,1,-70383,7187035] 

3^11^ 

5Nn 

10 

('10') 
1 0 4 y 

(2 3) 

^4 2 ) 

yes 

1 

6 

24 

48 

[1,-1,1,-5, 2] 

3^5^ 

5B 

6 

(§§) 

('1 O') ('1 I'l 
5l02/'5\01/ 

yes 

1 

1 

4 

80 

[1,1,0,504,-13112] 

2^3^ 

5S4 

5 

(§1) 

('2 O') ,'3 O') 

^ yo 2 J ^ y 4 4 J 

yes 

1 

6 

24 

96 

[0,0,0,9,-18] 

2^3^ 

7NS.2.1 

112 

(20) 
yo 4 ) 

(0 1) 

A 4 0 / 

no 

2 

2 

6 

18 

[1,-1,1,-2680,-50053] 

2 I 5272 

7Ns.3.1 

56 

(30) 

,(U) 

yes 

2 

2 

12 

36 

[1,-1,0,-107,-379] 

2 I 5272 

7B.1.1 

48 

ill) 

dll) 

no 

3 

1 

1 

42 

[1,-1,1,-3, 3] 

2^3^ 

. 7B.1.3 

48 

ill) 

dll) 

no 

3 

1 

6 

42 

[1,-1,1,-213,-1257] 

2^3^ 

7B.1.2 

48 

(20) 
yo 5) 

dll) 

no 

3 

1 

3 

42 

[1,-1,0,-107,454] 

7^13^ 

. 7B.1.5 

48 

(5 0) 
yo 2 ) 

dll) 

no 

3 

1 

6 

42 

[1,-1,0,628,-17823] 

7^13^ 

7B.1.6 

48 

(60) 
0 4 

dll) 

no 

3 

1 

2 

42 

[1,1,1,-6910,-232261] 

2 I 3 I 72 

, 7B.1.4 

48 

(n) 

dll) 

no 

3 

1 

3 

42 

[1,1,1,-50,293] 

2 I 3 I 72 

7Ns 

28 

ill) 

,^3 O') (1 O') 
?'<05/’V03/ 

yes 

1 

2 

12 

72 

[0,0,1,2580,549326] 

3^5^4E 

7B.6.1 

24 

(60) 
yo 6) 

(10) (11) 
?'<03/’V01/ 

yes 

3 

1 

2 

84 

[0,0,0,-43,-166] 

2^3^ 

, 7B.6.3 

24 

('6 O') 

('3 O') (11) 
’Voi/’VOl^ 

yes 

3 

1 

6 

84 

[0, 0,0, -3403, 83834] 

2'‘l3^ 

7B. 6.2 

24 

(60) 
1 0 6 

(20) (11) 
A05/’V01> 

yes 

3 

1 

6 

84 

[1,-1,1,-965,-11294] 

327213 I 

7Nn 

21 

(1 0) 
yo 6) 

(2 5) 

’ V 4 2 z' 

yes 

1 

8 

48 

96 

[0,-1,1,-10158,804091] 

23^29^ 

7B.2.1 

16 

(20) 
1 0 4 J 

('1 O') (11) 

^ yo 3) ^ yo 1 J 

no 

3 

1 

3 

126 

[1,-1,1,-5, 5] 

2^3^ 

7B.2.3 

16 

('2 O') 
\ 0 4 

(3 O') (11) 
’Voi/Aoi> 

no 

3 

1 

6 

126 

[1,-1,1,-95,-697] 

2^3'* 

7B 

8 

(30) 
V 0 5 / 

dlDdll) 

yes 

3 

1 

6 

252 

[1,-1,0, 3,-1] 

2^3'* 

IIB.1.4 

120 

(40) 

yo 6) 

dll) 

no 

3 

1 

5 

110 

[1,1,1,-305,7888] 

11^ 

IIB.1.6 

120 

(60) 
yo 4 ) 

dll) 

no 

3 

1 

10 

110 

[1,1,1,-30,-76] 

11^ 

IIB.1.5 

120 

(50) 

yo 7 ) 

dll) 

no 

3 

1 

5 

110 

[1,1,0,-3632,82757] 

11^ 

IIB.1.7 

120 

(7 0) 
'^05/ 

dll) 

no 

3 

1 

10 

110 

[1,1,0,-2,-7] 

11^ 

IIB.10.4 

60 

I' 10 0 'I (4 0) (11) 

y 0 io/5\o6/’^oi> 

yes 

3 

1 

10 

220 

[1,-1,0,-2745,-215726] 

3^11^ 

IIB.10.5 

60 

(' 10 0 ', (5 0) (11) 
*^0 10/’\07/’'<0iy 

yes 

3 

1 

10 

220 

[1,-1,0,-270,1777] 

3^11^ 

llNn 

55 

(1 0 

V 0 10 

)dll) 

yes 

1 

12 

120 

240 

[0, 0,0, -6682520, 39157150032] 

2^13^43^ 


Table 3. Exceptional Ge{(-) for non-CM elliptic curves E/Q (€ < 11). 
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group 

index 

generators 

-1 

t 

do 

di 

d 

curve 

N 

13S4 

91 

{ 3 0 
12 9 

\ (20) ('9 S') 
/5Vo2/’V06/ 

yes 

1 

6 

72 

288 

[0,1,0,-4788,109188] 

22315^13= 

13B.3.1 

56 

(3 0\ 
1 0 9 J 

/I 0\ (1 1) 

5\02/5\01> 

no 

3 

1 

3 

468 

[0,1,1,-114,473] 

3I72 

. 13B.3.2 

56 

(3 0) 
1 0 9 

(20) (11) 
5\01/5V01> 

no 

3 

1 

12 

468 

[0,1,1,-44704,-3655907] 

3I72 

13B.3.4 

56 

(3 0) 
1 0 9 J 

/4 0\ (11) 
5\07/5Vo1> 

no 

3 

1 

6 

468 

[0,1,1,-19322,1116938] 

3I72132 

. 13B.3.7 

56 

(3 0) 
1 0 9 

/7 0^1 (11) 

5\04/5V01> 

no 

3 

1 

12 

468 

[0,1,1, -7555032, -8001807082] 

3I72132 

13B.5.1 

42 

(5 0) 

\o s) 

(10) (1 1) 

^ \ 0 2 / ^ \ 0 1 j 

yes 

1 

1 

4 

624 

[1,-1,0,-139,965] 

215^172 

, 13B.5.2 

42 

(b 0\ 

1 0 8 J 

/2 O') /I 1') 
5 \oi/’voiy 

yes 

1 

1 

12 

624 

[1,-1,0,-126109,-17206537] 

215^172 

13B.5.4 

42 

(b 0\ 

1 0 8 J 


yes 

1 

1 

12 

624 

[0, 0, 0, -338, 2392] 

2®5^13^ 

13B.4.1 

28 

( 4 0 

1 0 10 


yes 

3 

1 

6 

936 

[0,-1,1,-2,-1] 

3I72 

13B.4.2 

28 

(4 0 

1 0 10 

).(??),(SJ) 

yes 

3 

1 

12 

936 

[0,-1,1,-912,10919] 

3I72 

13B 

14 

(2 0) 
\0 7 ) 

(10) /n't 
5\02/5V01/ 

yes 

1 

1 

12 

1872 

[1,-1,0,-2, 6] 

2I5272 

17B.4.2 

72 

( 4 0 

V 0 13 


yes 

1 

1 

8 

1088 

[1,1,0,-660,-7600] 

215^172 

, 17B.4.6 

72 

/ 4 0 
\ 0 13 


yes 

1 

1 

16 

1088 

[1,1,0,-878710,316677750] 

215^172 

37B.8.1 

114 

( 8 0 

V 0 14 


yes 

1 

1 

12 

15984 

[1,1,1,-8, 6] 

5272 

, 37B.8.2 

114 

( 8 0 

V 0 14 


yes 

1 

1 

36 

15984 

[1,1,1,-208083,-36621194] 

5272 


Table 4 

. Known exceptional Ge{^) for 

non-CM elliptic curves E/Q (1 > 11). 



group 

index 

generators 

-1 

t 

do 

di 

d 

curve 

D 

3Cn 

6 

ill) 

yes 

1 

4 

8 

8 

[0,0,1,-7,12] 

-7 

SCn.O.l 

60 

iVo) 

yes 

1 

2 

8 

8 

[0,0,1,-2850,-58179] 

-3 

5Cn 

20 

ill) 

yes 

1 

6 

24 

24 

[1,-1,1,-5, 2] 

-15 

5Nn.1.1.1 

20 

at),ill) 

yes 

1 

6 

24 

24 

[1,-1,1,-5, 2] 

-3 

7Cs 

56 

at),ill) 

yes 

2 

1 

6 

36 

[0,0,1,2580, 549326[ 

-3 

7Cn 

42 

(6 4 ) 

\6 e ) 

yes 

1 

8 

48 

48 

[0,-1,1,-10158,804091] 

-23 

7Nn.l.3 

42 

( 10 ) ( 12 ) 

1 0 6 z' ’ V 3 1 / 

yes 

1 

4 

24 

48 

[0,-1,1,-10158,804091] 

161 

llCn 

110 

(10 1 ) 

\ 6 10 ) 

yes 

1 

12 

120 

120 

[0, 0, 0, -6682520, 39157150032] 

-4 

llNn.1.3 

110 

/I 0 ') ( 16 ) 

\0 10 ) ^\3 1 ) 

yes 

1 

6 

60 

120 

[0, 0, 0, -6682520, 39157150032] 

44 

r 13B.12.1 

84 

/12 0 ') /I O') /I 1') 
\0 12 J ^\ 02 /^\ 01 / 

yes 

3 

1 

2 

312 

[1,-1,0,-139,965] 

17 

1 13B.12.2 

84 

( 12 0 ) ( 2 0 ) ( 1 1 ) 

yes 

3 

1 

12 

312 

[1,-1,0,-126109,-17206537] 

17 

r 13B.12.5 

84 

(12 0 ) /5 O') ( 11 ) 
'.O 12y’l03/’\01/ 

yes 

3 

1 

4 

312 

[1,-1,0,-139,965] 

221 

1 13B.12.3 

84 

( 12 0 ) ( 3 0 ) ( 1 1 ) 
'.O 12/A05/'’\01/ 

yes 

3 

1 

6 

312 

[1,-1,0,-126109,-17206537] 

221 

r 13B.12.4 

84 

(12 0 ) (^4 O') ( 11 ) 

yes 

3 

1 

6 

312 

[0, 0, 0, -338, 2392] 

8 

1 13B.12.6 

84 

( 12 0 ) ( 6 0 ) ( 1 1 ) 
VO 12/5'^09-'’V01/ 

yes 

3 

1 

12 

312 

[0,0,0,-12818,-745992] 

8 

r 17B.16.2 

144 

(16 0 ) (2 0 ) ( 11 ) 
VO 16/’'^0 10/’V01/ 

yes 

3 

1 

8 

544 

[1,1,0,-660,-7600] 

5 

1 17B.16.7 

144 

( 16 0 ) (7 0 ) ( 1 1 ) 
VO 16/Ao15/'’V01/ 

yes 

3 

1 

16 

544 

[1,1,0,-878710,316677750] 

5 

r 17B.16.8 

144 

( 16 0 ) (8 0 ) ( 1 1 ) 
VO 16/Ao11/'’V01/ 

yes 

3 

1 

8 

544 

[1,1,0,-660,-7600] 

85 

1 17B.16.6 

144 

(16 0 ) ('6 0') ( 11 ) 
VO 16/’'^09/’V01/ 

yes 

3 

1 

16 

544 

[1,1,0,-878710,316677750] 

85 

r 37B.11.1 

228 

('ll 0 ') 1^1 O') /I 1') 

V 0 27/A02.'’'.01/ 

yes 

3 

1 

6 

7992 

[1,1,1,-8, 6] 

5 

1 37B.11.2 

228 

('ll 0 ') ( 20 ) ( 11 ) 
VO 27/Ao1/’V01/ 

yes 

3 

1 

36 

7992 

[1,1,1,-208083,-36621194] 

5 

r 37B.11.6 

228 

(11 0 ) (6 0 ) ( 11 ) 

V 0 27y5l0 25 /’V0iy 

yes 

3 

1 

12 

7992 

[1,1,1,-8, 6] 

185 

1 37B.11.9 

228 

(11 0 ) (9 0) ( 11 ) 
VO 27/’'^0 29 2'’V01/ 

yes 

3 

1 

18 

7992 

[1,1,1,-208083,-36621194] 

185 


Table 5. Known exceptional Ge{() with surjective determinant for base changes of non- 
CM elliptic curves if/Q to quadratic fields 
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group 

index 

generators 

-1 

t 

do 

di 

d 

curve 

D 

3Cs.l.l[2] 

48 


no 

2 

1 

1 

1 

[1, 

0,1,4,-6] 

-3 

3Cs[2] 

24 

(§§) 

yes 

2 

1 

2 

2 

[1, 

1,0,220,2192] 

-3 

3B. 1.1 [2] 

16 

Col) 

no 

2 

1 

1 

3 

[1, 

o,b-bo] 

-3 

3Cn [2] 

12 

(?§) 

yes 

1 

2 

4 

4 

[1, 

1,1,3,-5] 

-3 

3B [2] 

8 

/2 0\ (11\ 

\0 2) ^ \0 1 ) 

yes 

2 

1 

2 

6 

[1, 

1,1,-3,1] 

-3 

3Nn [2] 

6 

(22) (01) 

\2 1 / ^ \2 0/ 

yes 

1 

4 

8 

8 

[0, 

0,1,-7,12] 

-3 

5Cs.l.l[2] 

240 

(10) 

1 0 4 / 

no 

2 

1 

1 

2 

[0, 

-1,1,-10,-20] 

5 

5Cs.4.1[2] 

120 

/4 0\ (10) 

\0 4 J ^ \ 0 4: J 

yes 

2 

1 

2 

4 

[0, 

0,1,-93,625] 

5 

5Cs[2] 

60 

(20) (10) 

\0 3) ^\0 4) 

yes 

1 

1 

4 

8 

[0, 

0,1,-2850,-58179] 

5 

5B.1.1[2] 

48 

(10) (11) 

\0 4 / ^ \0 1 J 

no 

3 

1 

1 

10 

[0, 

-1,1, 0,0] 

5 

. 5B.1.4[2] 

48 

(40) f 1 I'i 

0 1 ^ 0 1 y 

no 

3 

1 

2 

10 

[0, 

-1,1, -7820, -263580] 

5 

5Ns[2] 

30 

/O 4\ (2 0) I' 1 O') 

V10/’V03/’V04/ 

yes 

1 

2 

8 

16 

[0, 

0,0,-56,4848] 

5 

5B.4.1[2] 

24 


yes 

3 

1 

2 

20 

[0, 

0,1,-3,-5] 

5 

5Nn[2] 

20 

CDCtl) 

yes 

1 

3 

12 

24 

[1, 

-1,1,-5, 2] 

5 

5B [2] 

12 

/2 0\ (10) (11) 
V03/’v04/’V01/ 

yes 

1 

1 

4 

40 

[1, 

1,0,504,-13112] 

5 

5A4.1 [2] 

10 

/20\ {3 3\ {2 0\ 

\03/’'<41/5'^02.' 

yes 

1 

6 

24 

48 

[0, 

0,0,9,-18] 

5 

7Cs.2.1[2] 

224 

^2 0\ (1 0) 

\0 4 h \0 2 J 

no 

2 

1 

3 

9 

[1, 

-1,1, -2680, -50053] 

-7 

7Cs[2] 

112 

('3 0\ /'I O') 
\05/’'<02y 

yes 

2 

1 

6 

18 

[1, 

-1,0,-107,-379] 

-7 

7B.1.1[2] 

96 

/1 0\ (11) 

\0 2 J ^ \0 1 J 

no 

2 

1 

1 

21 

[1, 

-1,1,-3, 3] 

-7 

. 7B.1.2[2] 

96 

^2 0\ (11) 

no 

2 

1 

3 

21 

[1, 

-1,1,-213,-1257] 

-7 

7B. 1.4 [2] 

96 

(4 0\ /'ll') 

\04/’l01> 

no 

2 

1 

3 

21 

[1, 

-1,0,-107, 454] 

-7 

7Ns [2] 

56 

(0 6) (3 0) ( 1 0) 
V10/’V05/’v02/ 

yes 

1 

2 

12 

36 

[0, 

0,1,2580, 549326] 

-7 

7B.6.1[2] 

48 

(6 0) (10) /'ll') 
V06/’V02/’V0 1/ 

yes 

2 

1 

2 

42 

[0, 

0, 0, -43, -166] 

-7 

. 7B.6.2[2] 

48 

/6 O') ^2 O') ,'11') 

\06/Ao 1/Ao 1 / 

yes 

2 

1 

6 

42 

[0, 

0, 0, -3403, 83834] 

-7 

7B. 6.3 [2] 

48 

,'60') (30) (1 1') 
\06J^\03J^\0 1/ 

yes 

2 

1 

6 

42 

[1, 

-1,1,-965,-11294] 

-7 

7Nn[2] 

42 

,'3 3') /4 O') 

\6 4) ^\2 4) 

yes 

1 

8 

48 

48 

[0. 

-1,1,-10158,804091] 

-7 

7B. 2.1 [2] 

32 

(20) (10) (11) 

\ 0 4 / ^ \ 0 2 / ^ \0 1 / 

no 

2 

1 

3 

63 

[1, 

-1,1,-5, 5] 

-7 

7B[2] 

16 

/3 0) (10) (1 1) 
\05/’'<02/5'^0 1/ 

yes 

2 

1 

6 

126 

[1. 

-1,0,3,-!] 

-7 

11B.1.4[2] 

240 

(40) ('11') 

\0 9 J ^ \0 1 J 

no 

2 

1 

5 

55 

[b 

1,1,-30,-76] 

-11 

. 11B.1.9[2] 

240 

(90) (11) 

\0 4) ^ \0 1 ) 

no 

2 

1 

5 

55 

[b 

1,0,-2,-7] 

-11 

11B.10.2[2] 

120 

( 10 0 ) (2 0) ( 1 1 ) 
VO 10^’V07/'’V01/ 

yes 

2 

1 

10 

110 

[b 

-1,0,-2745,-215726] 

-11 

. 11B.10.4[2] 

120 


yes 

2 

1 

10 

110 

[b 

-1,0,-270,1777] 

-11 

llNn [2] 

110 


yes 

1 

12 

120 

120 

[0, 

0, 0, -6682520, 39157150032] 

-11 

13A4.1[2] 

182 

/80V f 10 10\ f2 0\ 
\05/’Vll 2/5^027 

yes 

1 

4 

48 

144 

[0, 

1, 0, -4788,109188] 

13 

13B.3.1[2] 

112 

,'3 O') (10) ('11') 
\09/’V04/’lO 1/ 

no 

3 

1 

3 

234 

[0, 

1,1,-114,473] 

13 

. 13B.3.4[2] 

112 

(3 0) (4 0) / 1 1') 
V09/’V01/’V01/ 

no 

3 

1 

6 

234 

[0. 

1,1,-44704, -3655907] 

13 

13B. 4.1 [2] 

56 

(40) (10) (11) 

VO 10/5'^04/’V0 1/ 

yes 

3 

1 

6 

468 

[0, 

-1,1,-2,-1] 

13 

13B.5.1[2] 

84 

(50) (10) (11) 

\0 8 J ^ \0 4 J ^ \0 1/ 

yes 

1 

1 

4 

312 

[b 

-1,0,-139,965] 

13 

13B.5.2[2] 

84 

(50) ,'20') (1 1') 
V08/’'<02/5'^0 1 ) 

yes 

1 

1 

12 

312 

[0, 

0, 0, -338, 2392] 

13 

13B.5.4[2] 

84 

(50) ,'40') (1 1') 
V08/’'<01/5'^01.' 

yes 

1 

1 

12 

312 

[b 

-1,0,-126109,-17206537] 

13 

13B[2] 

28 

(2 O') (10) (1 1') 
V07/5'<04/5'^01.' 

yes 

1 

1 

12 

936 

[b 

-1,0,-2, 6] 

13 

17B.4.1[2] 

144 

,'4 0') (10) (11) 

V0 13/’V02/’V01/ 

yes 

1 

1 

4 

544 

[b 

1,0,-660,-7600] 

17 

. 17B.4.2[2] 

144 

(4 0) ,'2 O') /I 1') 

V0 13/’V01^’V01.' 

yes 

1 

1 

8 

544 

[b 

1,0,-878710,316677750] 

17 

37B.8.1[2] 

228 

(8 0) /I O') (11) 
v0 14/’'^03/’V01/ 

yes 

1 

1 

12 

7992 

[b 

bb-8,6] 

37 

, 37B.8.3[2] 

228 

(8 0) /3 O') (11) 

V0 14/’'^01/’V01/ 

yes 

1 

1 

36 

7992 

[b 

1,1,-208083,-36621194] 

37 


Table 6 . Known exceptional Ge{(-) with non-surjective determinant for base changes of 
non-CM elliptic curves £1/Q to quadratic fields Q{'/D)- 
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group index generators —1 t do 

di 

d 

j'-invariant 

D 

N 

curve 






7CS.2.1 112 (§S),(J§) no 2 1 

[0, 0, -1, 21500(3a+5), 152590625o+129702031]/(a^-a+l) 

3 

18 

2i®3®5^43®41"'^ 

-3 

5472412 

13B. 1.1 168 (S 2) > (0 1) no 3 1 

[1, -1,1, -131a-205,1758a+2745]/(a2-a-4) 

1 

156 

-3®131®2“i®5”^ 

17 

2^5^ 

13B. 1.2 168 (0 ?) , (J }) no 3 1 

12 

156 

-3®118691^2”^5“^® 

17 

2^5^ 

[1, -1,1, -118691a-185455, -31941270a-49878411]/(a2-a- 

-4) 





13B.1.3 168 (g2),(ii) no 3 1 

3 

156 

-3®118691®2”i5“^® 

221 

2^5^13^ 

[0, 0, 0, -36119689047(lla+80), 177741267090426(2156a+15055)]/(a^-a- 

■55) 



13B.1.5 168 no 3 1 

4 

156 

-3^131®2“^®5”^ 

221 

2^5^13^ 

[0, 0, 0, 39865527(lla-91), 9591463206(2156a-17211)]/(a^ 

'-a-55) 





13B.1.4 168 (o?)>(oJ) no 3 1 

6 

156 

-2®3®13‘‘5"^ 

8 

5^13'* 

[a, 1, 1, -85a-126, 481a+684]/(a2-2) 

13B.1.7 168 (25),(Jl) no 3 1 

12 

156 

-2®3®13H7®29®5“1® 

8 

5^13'‘ 

[a, 1, 1,1602(2a-3), 164788a-235526]/(a^-2) 

13B.1.9 168 (gg),(j;) no 3 1 

3 

156 

-2®3®13'‘5”^ 

8 

5^13^* 

[a, 1, 1, 7140(2a-3), -1142440a+1631547]/(a^-2) 

13B.1.6 168 no 3 1 

12 

156 

-2®3®13H7®29®5“^® 

8 

5^13'* 

[a, 1,1, 270780(2a-3), 358789873a-512576303]/(o2-2) 
13B.1.8 168 (gi°o),(JD no 3 1 

4 

156 

-3®131®2“i®5”^ 

221 

2^5^13^ 

[0, 0, 0, 39865527(5a-64), 9591463206(860a-8607)]/(a2-a- 

-55) 





13B.1.10 168 (o°8 ),(J}) no 3 1 

6 

156 

-3®118691®2”^5“^® 

221 

2^5^13^ 

[0, 0, 0, -36119689047(56a+389), 177741267090426(24052a+166763)]/(a= 

-a-55) 



13B.1.12 168 (o^n),(J]) no 3 1 

[1, -1, 0, 22139a-56731, -3795909a+9723481]/(a2-a-4) 

2 

156 

-3®131®2“i®5”^ 

17 

2^5^ 13"^ 

13B.1.11 168 (Vi“ 2 ),(Ji) no 3 1 

12 

156 

-3®118691®2”i5“^® 

17 

225^13'^ 

[1, -1, 0, -20058779a-31341842, -70235146527a-109676893910]/(a^-a-4) 



17B.1.2 288 (gi°o),(Jl) no 3 1 

[a, -1, 0, 132(a-2), 304(-4a+7)]/(a2-a-l) 

8 

272 

-17^373®2”i’’ 

5 

2^17'* 

17B.1.10 288 (o°2 ).(oi) no 3 1 

[a+1, -a-1, 0, -175742(a+l), -12667110(4a+3)]/(a^-a-l) 

16 

272 

-172i01®2”1 

5 

2217'‘ 

17B.1.9 288 (gg),(j;) no 3 1 

8 

272 

-17^373®2”i’' 

85 

22172 

[0, 0, 0, -72762975(7a+30), 29048618250(532a+2199)]/(a^- 

-a-21) 





17B.1.6 288 (gS),(j;) no 3 1 

16 

272 

-17^101®2”i 

85 

22172 

[0, 0, 0,96798750975(7a-37), 1257319934817750(532a-2731)]/(aT 

-a-21) 




17B.1.15 288 (o®?),(Jl) no 3 1 

[a+1, a, a+1, -38178(a+l), 5707018a+4289808]/(a2-a-l) 

8 

272 

-17^373®2”i’' 

5 

2^17'* 

17B.1.7 288 no 3 1 

16 

272 

-17^101®2”i 

5 

2217^^ 

[a, a-1, a+1, 607a-1216, 9919a-17512]/(a^-o-l) 

17B.1.8 288 no 3 1 

8 

272 

-17^373®2”i’' 

85 

22172 

[0, 0, 0, -72762975(9a+37), 29048618250(756a+3107)]/(aT 

-a-21) 





17B.1.11 288 (V8 ).(JD no 3 1 

16 

272 

-17^101®2”i 

85 

22172 

[0, 0, 0, -96798750975(8a+85), -1257319934817750(1036a+7727)]/(a2-o- 

■21) 




Table 7. Known exceptional Ge{() for non-CM elliptic curves E over quadratic fields 
Cl{y^) with j{E) £ Q that are not base changes from Q (^ < 17). 
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group index generators —1 t do 

di 

d 

j-invariant 

D 

N 

curve 






37B.10.1 456 Co\%),Co°2),ihl) no 3 1 

[a+1, a, a, -78a-78, 418a+333]/ (a^-a-1) 

3 

3996 

-7III3 

5 

7" 

37B.10.2 456 () , ( g ?), (J 1 ) no 3 1 

[a, a-1, a, 2039213a-4078427, 2003653476a-3506903387]/(a^-a-l) 

36 

3996 

-7^37^2083^ 

5 

7^ 

37B.10.6 456 Co° Se) > it 25 ) ^ \) no 3 1 

[0, 0, 0, 94230675(lla-82), 28183538250(1859a-13602)]/(a2-a-46) 

12 

3996 

-7III3 

185 

74372 

37B.10.21 456 ('0° 2°6) . ( oS°3 ) - (S 1) no 3 1 18 

[0, 0, 0, 2444609268675(110-82), 108162428702847750(-1859a+13602)]/(a2- 

3996 

-0-46) 

-7^37^2083^ 

185 

74372 

37B.10.9 456 i\° 2 %) , it 2 %), il 1) no 3 1 9 

[0, 0, 0, 2444609268675(130-95), 108162428702847750(-2353o+17179)]/(o^- 

3996 

-0-46) 

-7^37^2083^ 

185 

74372 

37B.10.14 456 ( ^^^ 2°6 ) , ('cf i°6 ). ( J 1 ) no 3 1 

[0, 0, 0,94230675(130-95), 28183538250(2353o-17179)]/(o2-a-46) 

12 

3996 

-7H1® 

185 

74372 

37B.10.il 456 ( 0^ 26 ) > ( V 17 ) > ( 0 1 ) no 3 1 

[o+l, a, 0+1, -107609(o+l), 26319665a+19766651]/(a2-o-l) 

6 

3996 

-7H1® 

5 

7'‘37^ 

37B.10.17 456 ( '0° 2°6 ) . ( V n ). (J 1) no 3 1 36 3996 

[o, 0-1, 0+1, 27916834230-5583366848, 101558059929979a-177727302798321]/(oT 

-7^37^2083^ 

-0-1) 

5 

7'‘37'‘ 


Table 8 . Known exceptional Ge{() for non-CM elliptic curves E over quadratic fields 
Q{'/D) with j{E) € Q that are not base changes from Q (f > 17). 
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group index generators 

-1 

t 

do 

di 

d 

D 

N 

curve 








5Nn.2.2[2] 80 ill),{ID 

[0, a-1,1, 42a-95,192a-332]/(a^-a-l) 

no 

2 

3 

3 

6 

5 

31^ 

5Ns.2.1[2] 60 (gg),(?S) 

[ 1 , 0 , 1 , 2 a, 2 a+ 2 ]/(a 2 -a- 1 ) 

yes 

1 

2 

4 

8 

5 

2219^ 

5Nn.3.2[2] 40 (i|),(J5) 

[ 0 , -a- 1 , 1 , - 1 , 2 a+l]/(a 2 -a-l) 

yes 

2 

3 

6 

12 

5 

31^ 

7NS.6.1.2 84 {IDDIDAID yes 

[0, a+1, -1, 3351111a+661990, -762997059a+3083596118]/(a^ 

1 

-a+ 1 ) 

2 

12 

24 

-3 

7^^ 13^ 223^ 379^ 

7Nn.0.1.1[2] 84 (^)),(?g) 

[0, 0, a, -686(4a+13), 104431a+347925]/(a2-a+2) 

yes 

1 

4 

24 

24 

-7 

287211223229 I 

7A4.3C2] 84 {ID,{ID 

[1,1, a+3, -14a-12, -33a-17]/(a^-a+2) 

yes 

1 

4 

8 

24 

-7 

2^239^ 

7A4.1[2] 28 (^§),(fi),(g§) 

[-a+3, 5a-7, 6a-2,1217a-851, -19779a-3823]/(a2 

yes 

-a+ 2 ) 

1 

4 

24 

72 

-7 

29792 

7S4.1[2] 14 (g^),(g|),(g§) 

yes 

1 

8 

48 

144 

-7 

2 ® 11 ^ 


[-2a, 0, 2a+2, 7a-5, -a+3]/(a^-a+2) 


llB.l.l 120 (J°),(“) 

[a+1, -1,1, -2a-3, 2a+3]/(o2-2) 

IIB.1.2 120 (§?),(Ji) 

[a+1, -1,1, -947a-1473, -20242a-29187]/(a2-2) 

IIB.1.3 120 (g°),(“) 

[0, 0, -1,1210a+814, 7986a-33850]/(a2-a+2) 

IIB.1.8 120 (n)-(Ji) 

[0, 0, 2a-l, 2662(-55a+92), 10629366a+34424653]/(a2- 

IIB.1.10 120 

[a+1, -a-1, a, 171a-326, 3124a-4706]/(a^-2) 

IIB.1.9 120 

[a+1, -a-1, a, 114516a-178196, -26700245a+38567674] 

llNs 66 (§g),(ro°):(J^) 

[0, -a, 1, -711a-1975, 32565a+51092]/(a2-a-3) 

IIB.10.1 60 

[a, a, 0 , 6a-10,16a-26]/(a^-2) 

IIB.10.2 60 

[a, a, 0, 3786a-5890, -161936a+233494]/(a2-2) 

IIB.10.3 60 

[0, 0, 2a+2, 352(55a+37), -511107a+2166385]/(a2-a+2) 

IIB.3.1 24 

[l,l,a, 0 , 0 [/(a 2 -a+ 2 ) 

IIB.3.2 24 (gS),(g?),(Jl) 

[1,1, a, 35a-135, -217a+705]/(a^-a+2) 

11A5.U2] 22 ill),{ID 

[0,0,0,3841a+8421,76280a+1073622]/(a^-a+3) 

IIB 12 

[l,a+l,0,a-4, -a-5]/(a2+2) 


no 

3 

1 

1 

110 

8 

2^231 

no 

3 

1 

10 

110 

8 

2^231 

no 

3 

1 

5 

110 

-7 

11-^23= 

no 

3 

1 

10 

110 

-7 

11'‘23^ 

a+2) 

no 

3 

1 

2 

110 

8 

24l'‘23 

no 

3 

1 

5 

110 

8 

2Hl'‘23 

/(a^-2) 

yes 

1 

2 

20 

200 

13 

23^521^ 

yes 

3 

1 

2 

220 

8 

2^23^ 

yes 

3 

1 

10 

220 

8 

2^23^ 

yes 

3 

1 

10 

220 

-7 

2®11'‘23' 

no 

3 

1 

5 

550 

-7 

2^112 

no 

3 

1 

10 

550 

-7 

2^112 

yes 

1 

12 

120 

600 

-11 

2®3'‘103' 

yes 

3 

1 

10 

1100 

-8 

3^11^ 


Table 9. Some exceptional Ge{D for non-CM elliptic curves E over quadratic fields {i < 11). 
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group 

index 

generators 

-1 

t 

do 

di 

d 

D 

N 

curve 










13Ns 

91 

/20\ /0 12\ f 1 0\ 

\07^5\1 0/)'<022' 

yes 

1 

2 

24 

288 

8 

52722632 

[ 0 ,1, 0+1,144550-27951, 2058670o-3164816]/(o2 

-2) 







17B.4.3[2] 

144 

('4 0 '1 ('3 0') (11) 
V 0 13/’V0 12 /’V 01 / 

yes 

1 

1 

16 

544 

17 

28472 

[0, 0-1, 0+1, 620-174, 3780-955]/( 0 - 0 - 4 ) 








' 17B.4.1 

72 

(40) (10) (11) 

V0 13/’v03/’V01/ 

yes 

1 

1 

4 

1088 

5 

2^29^ 

[1,1, 0 , -3o-2, 2o]/( 0 ^- 

0-1) 








17B.4.3 

72 

/4 0 ') (30) ('11') 

\0 13yA01/’^01/ 

yes 

1 

1 

16 

1088 

5 

2^29^ 

' [1,1, 0 ,447o- 

4152, -85116o+59004]/(o -0-1) 








' 17B.2.1 

36 

/2 O') (10) (11) 
\09/'’V03/5\01/ 

yes 

1 

1 

8 

2176 

-4 

2'‘17^ 

[ 0 + 1 ,1, 0, lOo 

-54,80o-132]/(o2+l) 








17B.2.3 

36 

,'20') ('30') I'll') 
V092’V01/’V01/ 

yes 

1 

1 

16 

2176 

-4 


' [ 0 + 1 , -1, 0 + 1 , 

-450+46, 

-21o-161]/(o2+l) 








17B 

18 

,'3 O') ,'1 O') (11) 
V062’V03/’v01/ 

yes 

1 

1 

16 

4352 

-4 

5^17^ 


[0, a-1, a, 790+41,14a+286]/(o2+l) 


.19B.7.1 120 no 3 1 

I [o,-0-1, 0,-7a+6, a+20]/(a^-a-3) 

I 19B.7.2 120 no 3 1 

^ [o, - 0 - 1 , 0, 73118O-178094,15174381o-35305705]/(o2-a-3) 

.19B.7.4 120 no 3 1 

I [0, 0 + 1 , 0, -7314O-12540, 753536a+12257]/(a2-o+l) 

I 19B.7.10 120 no 3 1 

[0,4a+l, 0,26407230-7167660, 5225465897o-5332549369]/(a2-o+l) 

.19B.7.8 120 no 3 1 

I [o, - 0 + 1 ,1, -26410+1957, -1369o-100185]/(a2-o-3) 

I 19B.7.5 120 no 3 1 

^ [o, -0+1,1, 263954840-64292143, -103917992039a+241830189815]/(o2 

.19B.8.1 60 yes 3 1 

I [a+l,l,l,-2a-2,-6o-8]/(a2-a-3) 

I 19B.8.2 60 (§i° 2 ),(g?),(Jl) yes 3 1 

[o+l, 1,1, -17270-4177, 66984o+119182]/(o2-a-3) 

19B.8.4 60 (§i°2).(^i°o),(Si) yes 3 1 

[0, 5a+5, 6, -72900-12540, -807848a-22730]/(o2-o+l) 

.19B.4.1 40 no 3 1 

I [-3, 2o-5, -2a+4, -7a+13, 5o-7]/(o2+2) 

I 19B.4.2 40 no 3 1 

[-3, -4o-2, 2a-l, 3717a-1680,108119o+59932]/(o2+2) 

19B 20 yes 3 1 

[0, -4o+8, -9a+9, -73o+14, -87a+lll]/(o2+2) 

/ 23B.2.1 48 (o 12 ) 1 ( 05 ) 5 ( 01 ) no 3 1 

j [1, 0+1, 0+1, 29o-65, -120a+121]/(a^-o+2) 

I 23 B. 2.5 48 (§ i°2 ),(§?),( S i) no 3 1 

[ 1 , -0-1, 0+1,160, -42o-21]/(o2-o+2) 

23B 24 (gi°4),(J?),(Si) yes 3 1 

[1, -o, o, 4o-3, -0-1]/(o^-0+3) 


3 

1026 

13 

13^ 

18 

1026 

13 

13^ 

9 

1026 

-3 

24347219. 

18 

1026 

-3 

24347249. 

6 

1026 

13 

13^ ig'^ 

9 

1026 

13 

13^ ig'^ 

■3) 




6 

2052 

13 

13^ 

18 

2052 

13 

13^ 

18 

2052 

-3 

28347249. 

9 

3078 

-8 

213 ^ 9 ^ 

18 

3078 

-8 

213^92 

18 

6156 

-8 

3^5" 

11 

5566 

-7 

2^23^ 

22 

5566 

-7 

2^23^ 

22 

11132 

-11 

3^23^ 


Table 10. Some exceptional Ge{(-) for non-CM E over quadratic fields (13 < £ < 23). 
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group 

index generators 

-1 

t 

do 

di 

d 

D 

N 

curve 









29B.7.1 

120 

no 

3 

1 

7 

5684 

-4 

29^ 

[l,a,l,-l, 0 l/(o 2 +l) 








29B.7.2 

120 

no 

3 

1 

28 

5684 

-4 

29^ 

[1, a, 1, 2080a-3751, 73352a-79386]/(a2+l) 








29B.7.4 

120 ("^01 ('40 \ fii'i 

\0 25 /’V0 15/’V01/ 

no 

3 

1 

14 

5684 

-4 

29'‘ 

[-a, a-1, -a 

1 , -141a-157, -2591a-5674]/(a2+l) 








29B.7.8 

V0 25 /’V0 22 /’'<01/ 

no 

3 

1 

28 

5684 

-4 

29'‘ 

[a, 2a-l, -2, -3645a-2261, 107979a+8482]/(a2+l) 








29B.4.1 

00 f 4 0 W 1 0 W 1 1 

'^0 22 /5\021A01/^ 

yes 

3 

1 

14 

11368 

-4 

2'‘29^ 

[a+1, 5a+3, 

-4,120+24, 296a+232]/(a^+l) 








29B.4.2 

60 (^ 2 ° 2 ),(g?),(j;) 

yes 

3 

1 

28 

11368 

-4 

2^29^ 

[o+l, -5a+l, 4,144a+564, -5944a+2472]/(a2+l) 








29B 

30 

yes 

1 

1 

28 

22736 

-7 

2'‘29^ 

[ 2 a, - 1 , -a- 

-2, 4a+8,12a-24]/(a2-a+2) 








31B.5.4 

320 (E2°5).(o2°4),(SO 

no 

3 

1 

15 

2790 

-11 

3®5^31'‘ 

[0, 3, 3,136740690a-686742129, 1958685589751a-6654652545690]/(aT 

-a+3) 




31B.5.11 

090 fS 0 \ ('ll 0 '1 ,^1 1 \ 

VO 25/ ’VO 20/’V01/ 

no 

3 

1 

30 

2790 

-11 

3®5^31'‘ 

[0, 3, 3, -142290a-572319, 65600681o+157039605]/(a2-a+3) 






31B.6.4 

160 

yes 

3 

1 

30 

5580 

-11 

283852314 

[0, -3, 2a, - 

2276640a-9157149,-4205273505a-10078006254]/(a2 

-a+3) 





31B.7.1 

64 ill),ill),ill) 

no 

3 

1 

15 

13950 

-3 

72312 

[3, -5, -4,195a+198, 5134a-6388]/(a2-a+l) 








31B.7.3 

64 

no 

3 

1 

30 

13950 

-3 

72312 

[3a-3, 5a, - 

3, -5546a-1044, -214581a+68920]/(a^ 

-a+l) 







31B 

oo / 3 0 W 1 0 W 1 1 \ 

'.0 21/’V03/’V01/ 

yes 

3 

1 

30 

27900 

-3 

7'‘31^ 

[3, -a-2, -a, 95a-370,1614a-6420]/(a^-a+l) 








37B 

38 (gi°9).(s^),(j;) 

yes 

1 

1 

36 

47952 

-11 

243874 

[0, -a+4, 6 , 

-16170a+16494,-431712a+1866132]/(, 

a^-a+3) 







41B 

42 ill),ill),ill) 

yes 

1 

1 

40 

65600 

-4 

2^5^41^ 


[o, 3a+l, 0,14a, 13a+5]/(a^+l) 


Table 11. Some exceptional Ge{(-) for non-CM elliptic curves E over quadratic fields (£ > 23). 


44 







group index 

generators 

-1 

t 

do 

di 

d 

D 

N 

curve 









7Cs.1.1 336 

(10) 

\o 3 ) 

no 

3 

1 

1 

6 

-23 

2872 

[1, -a^+a, a^+a, -3a- 

2, - 2 a- 2 ] 








7CS.1.4 336 

(4 0) 

\o eJ 

no 

3 

1 

2 

6 

-23 

2® 7® 

[l,4a^+2a+4,0,56a^- 

-114a-120, -316a^+224a+512] 







7CS.6.1 168 

(60) (10) 

\ 0 6 / ’ ^ 0 3 y 

yes 

3 

1 

2 

12 

-23 

285272 

[a+1, a+1, a^+a, 12a^+20a+5, 72a^-49a-47] 








-31B.5.1 320 

(50) (10) (11) 

\0 25/'’\03/’\01^ 

no 

3 

1 

3 

2790 

-23 

5^97^ 

[o+l, a, a, -40a^+23, 

-179a^+2231a+1786] 








31B.5.3 320 

(50) (30) (11) 

V0 25 Gt01/’t01^ 

no 

3 

1 

30 

2790 

-23 

5^97^ 

‘ [a+l,a,a,474525a2-: 

3200a-273302, -903705590^- 

718819390-2769254] 





- 31B.5.6 320 

(50) (60) (11 ) 
Vo25/’v0 16G\011 

no 

3 

1 

6 

2790 

-23 

5^31®97^ 

[a+1, a^+a+1, 0, -38977a^+261a+22342, 4547700a2 

-65990438a-52406399] 




31B.5.16 320 

( 5 0 ) ( 16 0) ( 1 1 ) 

V0 25 /’ \ 0 6/’\01/ 

no 

3 

1 

15 

2790 

-23 

5^31®97^ 


[a^ 2a^+3a+l, -2, -62172325a^+61226571a+68084562,192717035605a^+178577917357a+44210952860] 

31B.6.1 160 (o26)>(o3):(oi) yes 3 1 6 5580 -23 5^97^ 

[a^+a+1, 3, 2a^-a, a^+2a+3, 9a^-a-6] 

31B.6.3 160 (o 2 ° 6 ).(oi):(oi) yes 3 1 30 5580 -23 5^97^ 

[a, 2a, a^-a, -31743a^+58113a-42806, -40571500^+71080290-5326264] 


Table 12. Some exceptional Ge{£) for non-CM elliptic curves E over Q[a]/(a^ — + 1). 
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